I mean you are more tightly coupled. It’s way more likely that someone is going to pull the git submodule (especially if you’re doing this with multiple projects) than the someone updating the version of the library inadvertently. This applies even more if you’ve created the library and deployed it to your own artifactory yourself.