This is actually not that different from Go in practice; many Go binaries are linked to libc: it happens as soon as you or a dependency imports the very commonly used "net" package unless you specifically set CGO_ENABLED=0, -tags=netgo, or use -extldflags=-static.
Are we just talking about standard rop gadget vulnerabilities, or is there something else that's a problem with it?
The only issue is that some lib sometime do not compile (or at least without some workaround) with musl. Although it often concern one specific platform (looking at you Mac OS).
It does in general, though I don't really think this is a big pain or blocker in the general case, there are very version requirements around libc.
> Go doesn't have this problem afaik as it has its own stdlib and runtime.
That's also true, but it's not really a pure win. Choosing not to use a battletested libc has led to a variety of subtle and difficult to diagnose bugs over the years, e.g. https://marcan.st/2017/12/debugging-an-evil-go-runtime-bug/
I went on a wild goose chase to build static Rust but deno can't target musl yet and the issue is a few years old
