Ironically, a small programming language is much more vulnerable to telemetry-code injection by its maintainers than a large one like Go, where multiple non-Google-affiliated members of the community are actively following each commit made to the compiler source code. As long as you build your compiler from source (and have always done so, per Reflections on Trusting Trust) then you benefit from those eagle-eyed auditors for free. That said, it's important that the language have good governance with representation from firms other than the original creator.

Pip is separate from python itself. With a given language can I download packages with curl and install them myself? I think I can trust curl.

The problem is not only that the tool connects to the networks, but who is behind the tool. Google is a company whose business is collecting all the information on people it can. I don't think those in control of python/pip have the same incentives.

there's nothing preventing you from downloading go code manually without the package manager and using it that way

Or even easier--pointing your Go tool at a package proxy of your choice.

yup; you can easily run your own or just set GOPROXY=direct to use go modules without a proxy at all.