“Malware can simply store payloads and retrieve them from the proxy when needed.”
Homebrew is a Ruby project with no Go code, and it has more than 70,000 entries in Go’s checksum database. Ask sum.golang.org about any repository and Google’s proxy fetches it and keeps a copy. That makes proxy.golang.org a free 500MiB-per-module file host that CI allowlists already trust. The source can vanish and the payload stays on Google’s servers.