docs: Clarify vendored sources as read-only and way to modify

src/doc/man/cargo-vendor.md

@@ -21,6 +21,11 @@ stdout after `cargo vendor` completes the vendoring process.
 You will need to add or redirect it to your Cargo configuration file,
 which is usually `.cargo/config.toml` locally for the current package.
 
+By default, Cargo treats vendored crates as read-only as it does crates.io.
+To modify a vendored crate the correct way is to use `[patch]` or a `path` dependency,
+and Cargo will then correctly handle the crate on incremental rebuilds as it knowns
+that it is not a read-only dependency.
+
 ## OPTIONS
 
 ### Vendor Options