Dynamic linking for the reason of security is the wrong solution, only propagating the problem of language and application developers to the downstream package distrobuters.

It is basically saying, yeah, I wrote this package with this language and dependencies, but you will be the one paying for my choice of technology.

Of course, down stream people also shouldn’t have accommodated these softwares. Except they did and now, there are multitudes of ecosystems operating this way.