I tend to agree with this Reddit commenter:
I don’t think you need vendoring anymore. Now we have multiple layers of safety - the shared global cache hosted by Google, the cache on each developer’s machine in their go path, and Github. Your dependencies are probably replicated as much as your source code using them, if not even more frequently.