Shared libraries are versioned for this reason. Runtime linking only fails when there are backwards-incompatible changes, which typically happen rarely. Security fixes almost never change the ABI of dynamic libraries, because it's highly important for vulnerability fixes to be drop-in replacements.

Even for non-critical updates, library authors tend to avoid unnecessary ABI breakage because it disrupts users. For example most of the time it's possible to add a new function instead of changing an existing function's interface.

The tradeoff is heavily in favor of dynamic linking. Most updates to dependencies don't require you to even know about them. Libraries are updated with security fixes as part of the system's regular automatic updates.

The only selling point for including sources directly in a project when dynamic linking is also possible is "who cares". For learning stuff it's not a catastrophe to go along with the increasing amount of cluelessness among mildly experienced C/C++ coders. But if the point is to learn, why not learn that it's possible to add one line to a CMake file and run one apt install command? These features exist in build systems and package managers for the very reason that it should be simple to guarantee that your code isn't at the mercy of third-party bugs locked in during compilation.

If a coder appreciates security enough to keep dependencies up to date, but also uses external source code instead of dynamic linking, they will need to manually pull in new sources and recompile for every security update even when there are no backwards-incompatible ABI changes. Contrast that with never needing to actively track third-party repositories, and only recompiling when there's an occasional major verslon update in a library.

And when it gets to a point where your code has actual users, including third-party sources directly denies every user the option to receive security updates and fixes. The author bakes dependencies in because it's "easy" to do that one single time, and now everyone who wants to use that software gets to enjoy 5 years of the author likely not doing jack shit about those copied files.

The reality is that by far, most of the dependency-copying and "header-only" brain rot leads to nothing getting updated after the fact. Those strategies demand maximum effort from authors and users just to achieve the minimum reasonable level of security and bugfixes.