I'm curious what you mean about vendoring.

In go, vendoring dependencies just copies the deps out of the module system into the local tree and it's managed the same as not vendoring. It won't even build of the go.mod has changed without also updating the vendor tree.

Right - a copy is a cache, and you have to manage that; when to update it, when vulnerabilities are discovered in the deps you have copied, it's up to you to change the version in your cache.