Even if GOG switched to ScummVM, why insist on using ScummVM internal patches? And besides, that's just GOG. If you don't get your sierras from GOG, you decide if you want to play 'em on ScummVM, DOSBox, or an actual contemporary PC. Only reason you might not take the GOG version and run it on DOSBox or an actual old beige box is if they only include the resource files and leave out the interpreter and drivers since ScummVM doesn't need those.
"All it takes is for a new Windows version to not support DOSBox and that's it." do you realize how unlikely that is? The Windows devs wouldn't need to just drop the ball, they'd have to drop three dozen to break compatibility that hard. And DOSBox is not just available for Windows, let's not forgot, any more than ScummVM is.
Edit: the same can be said about ScummVM to be entirely honest. If you can't guarantee a future version of Windows will still be able to run DOSBox, you can't guarantee it'll still run ScummVM either.
Pros of internal ScummVM patches: they can be bound to specific versions of specific games via signatures.
Cons: every time you make one, you have to update ScummVM and all affected users have to download a whole new copy of ScummVM, because they're inherently a part of ScummVM.
Pros of external patch files: they're easy to make (just use SCI Companion and export the affected area), they can cover most any type of resource instead of only scripts, they're nice and small compared to the whole SVM.
Cons: you can't automatically match a given patch to a specific version of a specific game (kinda re like IPS vs BPS in that regard).
...I feel kinda inspired to add signature matching support to SCI11+ now. A special header (if the first byte's not & 0x80 it's not a valid raw patch) to state the target's game ID and the bytes to find, followed by the replacement. 11 2B ; "11+" header, as opposed to 83 00 for a text resource.
4B 51 35 00 00 00 00 00 ; KQ5
01 00 ; one block to replace
09 00 ; nine bytes of signature
11 00 ; seventeen bytes to replace
70 6F 69 73 6F 6E 6F 75 73 ; 'poisonous'
76 65 6E 6F 6D 6F 75 73 20 73 6E 61 6B 65 21 22 20 ; 'venomous snake!" ' with a padding space because we're keeping it simple.
Silly example considering KQ5 isn't SCI11 so my terp can't run it but it serves its purpose. If I didn't want to keep it simple I could add block types so the patch could move data around, like "copy 0x1D2 bytes from 0x79 to 0x78", so the replacement can be only eight bytes long.