To be fair this does only work in ecosystems where libraries are stable and don't break every 3 months as it often happens on the JS world.

You can vendor your left-pad, but good luck doing that with a third-party SDK.

... you vendor the third-party SDK? Nobody worth working with is breaking their SaaS APIs with that cadence.