Why aren't we using them in Debian? Did we already have this discussion,
and I have simply missed it?
I think the main reason is that there is simply no concept of ABI compatibility in Go. Even your hypothetical "minimal security fix" is quite likely to break ABI in the Go sense, in my (old) experience.
Speaking as the person who implemented most of -buildmode=shared, I really should have worked on that end of things first :(
Cheers,
mwh