If you go to the developers page https://www.steinberg.net/en/company/developers.html there is a single link to download the VST3 SDK (note that there is no version mentioned on that page which used to be the case prior to 3.6.10) so it is already unclear which version you are downloading until you actually download it.
I did create a plugin with 3.6.9 prior to the release of 3.6.10. Since it is open source anybody can download it and compile it for their own use. In the install instructions I have to provide details on how to get 3.6.9. If I tell my users to go to https://www.steinberg.net/en/company/developers.html then they will end up downloading the wrong version and it won’t work for them.
What is the recommended approach?
You can just use the github repository in the case of open source and use the revision number of the specific release.
As you know, github does not include the VST2 SDK so that is not a practical solution since 3.6.10 and prior do include it. Moreover the github repo is not tagged with releases: there is only 368 and 367 releases (which is probably a mistake/oversight)
I really don’t think you should expect users to be using the latest and greatest versions of the SDK (each new version may fix issues, but introduces new ones and require changes which is not always practical). You really need to provide access to past SDK builds. I am not asking you to support old versions, but since you released them at some point they should remain available for at least some good amount of time.
I used to manage the glu open source project which I no longer support, but there are still every single release available https://bintray.com/pongasoft/glu/releases