vcpkg for dependencies
Currently, WinDirStat includes several third-party libraries in its own source tree, which requires maintainers to keep those up to date.
Consider using vcpkg for dependencies, which lets you offload this maintenance to a central source. It appears that all dependencies of windirstat are available in vcpkg.
sorry but it's unlikely that this is ever going to happen the way you seem to envision it. Supply chain attacks abound in our day and age and package managers are part of the problem as long as you use the default "upstream". And while it's true that this third-party code integration causes extra effort, it's comparably small after the initial integration.
If we start using a larger number of third party libraries I'll possibly revisit this topic and consider some package manager, be it vcpkg or conan or something else altogether. But even then it's probably going to be our own registry/remote (insert whatever the lingo of your favorite package manager 😉).
At this point I don't see any advantage of vcpkg over other solutions, given it doesn't come pre-packaged with Visual Studio (well it probably leads with a slim margin over conan, if we consider my experience with the tool). So since I have to either "bootstrap" (= download) or build it myself, there's no tangible difference to alternatives. But I have successfully used the recipes provided by package managers in builds. And yes, that is a tedious part when integrating third-party code, albeit one that has to be done just once. Alas, given vcpkg seems to be built exclusively on CMake under the hood, it doesn't exactly add to its attractiveness as a tool 😁.