> Of course the problem here is: what happens when a major bug like Heartbleed is found in a library used by 500 things?

You run away screaming. Static compilation used to be the only option 30 years ago, and there are multiple reasons why mainstream moved away from it.