Just because most projects’ builds have large attack surfaces doesn’t mean we should accept that. The build and IDE tooling for Go does not trust the code it consumes.
That doesn't mean anything, most compilers for most languages do not behave any differently - which is exactly why few projects use those directly instead of using some more capable build system.
If i want to, e.g., parse an XML file and generate some code from it and the Go tools (or whatever) doesn't allow for that, i'm not going to not do that, i'm going to write a `build.sh` script (or use some more capable build system, like premake or whatever) that does exactly what i want. Go (or whatever) didn't made anything more secure here, it just kicked the can down the road for someone else to pick it up so it wont have to - but the can still needs to be picked up regardless.