Why runc is vendored in k8s?

Asking for help? Comment out what you need so we can get more information to help you!
Hi! I am trying to understand, why runc, a low level container runtime(implementing OCI standart) is vendored ( https://github.com/kubernetes/kubernetes/tree/master/vendor/github.com/opencontainers/runc) in k8s?

Also, would be great to get some info why vendoring third party packages is needed and what are the benefits? is there any alternative to it?

Cluster information:

Kubernetes version:
Cloud being used: (put bare-metal if not on a public cloud)
Installation method:
Host OS:
CNI and version:
CRI and version:

You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read.