Hello, Dan
thanks for pointing the correct issue. I was really not aware of that one =)
"Moodle has always bundled the required third party libraries."
Ok, I agree with that, but this is not a reason to not change. There is several advantages in not "bundling" libraries together with your code (of course, there is some disadvantages too, as the recent case with the npm repository and a "rebel" maintainer, but these are most isolated examples).
Also, Moodle has a "command line upgrade tool", that can, of course, run the "composer update" command if that is too much for every moodle admin out there.
About the packages with shell scripts and everything else, well, this depends on what you are including. I am pretty sure all the cited Moodle core dependencies should not do anything like that. Also, you can tweak your webserver to deny thing in "/vendor" directory.
About the "not straight embeds", using composer, you can fork the libraries that moodle changes and use the forked libraries instead of relying on *_README.txt files to explain what was done and also keep the moodle core code history more clean.
Ah! At last but not least, let's not think our users/developers/admins can not do things. We need to raise the bar sometimes so people keep improving =)
Kind regards,
Daniel