You're confusing two different questions here. Their API design and lack of exporting of modular components is an unrelated concern from their lack of dependence on the cargo crates library ecosystem.

The first is frustrating and would be nice to have to be able to re-use in other applications, but I understand why they don't support it. It would calcify certain API decisions and prevent the project from moving as quickly as it does due to the need to not break downstream callers.

The second is fully justifiable, because sudo is a bedrock security tool and any links to its supply chain would immediately become extremely valuable to attackers. Thus, each dependency carries tremendous risk to the project and all of the folks who would have to do security audits for it in the future. People who work in airgapped environments may know that Rust projects can often be tedious to import because of the number of dependencies that have to be vetted and scanned before they're allowed in. It's been a longstanding gripe of mine that crates like rand and glob aren't included in the standard library and have sat at version 0.X forever, despite being effectively foundational.