I think the release of 3.7.2, which is a broken release (see vst2 wrapper assert failure and json parsing issue on win10), simply demonstrates another side of this problem. Because the only full sdk available is the “latest” one, anybody downloading the latest one gets a broken one, with no way of downloading a non broken one. As you stated, github is not the full sdk. At this moment, there is just not a non broken sdk available.
Here is a very simple way to fix this issue: since the source code is already on github, why not use the release feature on gihub to simply attach the full sdk as one of the binary of the release? It wouldn’t be on the Steinberg website, but at least it would be attached to a github release tag and available to anybody who needs it for any kind of reason. The website could simply point to it for “old” sdks… This is actually how I distribute my own vsts (see example) so there is a history of all the releases and they are properly attached to a github tag…