AFAIK, Golang's module system (mentioned in the article) protects against this. From [1],
The revision must be an ancestor of one of the module repository’s branches or tags. This prevents attackers from referring to unapproved changes or pull requests.
The revision must be an ancestor of one of the module repository’s branches or tags. This prevents attackers from referring to unapproved changes or pull requests.
1: https://go.dev/ref/mod