Hi Paul,
Security isn't the only reason embedded libraries are bad.
On the other hand, what about the right of an upstream development team to specify the versions of libraries which they require, patching them as necessary?
Even with libraries built in, the Ardour package is still smaller than iceweasel, and a great deal smaller than openoffice.org.
I seriously doubt that Ardour is installed on any security-critical servers.Don't you care about the security of users desktops or audio workstations?
Of course, but as a regular Ardour user I'll take a stable version with a theoretical security exploit over a buggy version any day. Also, it's not required for Ardour machines to be connected to the internet at all, let alone be online 24/7. So there's a great deal of difference between a DAW and a web server.
Cheers! Daniel