"Vendoring" is 100% a word. It may not be in the OED or MW, but those things are descriptive, not prescriptive. Words become words when they are used as words, and "vendoring" is used as such. See:
"Vendoring" is a term of art that is used to describe incorporating third party dependencies into your (source code) repository. While not a perfect fit it seems close enough - closer than escrowing where typically a third party that has no immediate use for the artifict is the one holding it.
Things become a word when there is a critical mass of people that use the word. In this case vending initially refereed to placing a copy of the source code of the third party library into /vendor/ subdirectory, thus "vendoring" it. It has since been extended to similar use cases and has become part of the software developer jargon.
Maybe this is just me being a physicist, but I would have trouble applying the notion of escrow to anything that does not obey a law of conservation...
“Put that idea in escrow”—I assume I have to write it down first? “Put our incrementing page view count in escrow”—uh...? “Put my time in escrow”—how on earth am I going to get it back?
Similarly “escrowing your software dependencies”, hard to interpret if I didn't know the context. Whereas “vendoring” is similarly opaque but immediately recognizable as jargon and has made it into tools (`go mod vendor` and `deno vendor` for example).
