When importing a repos file containing specific commits, vcstool might fail if the commit is not available locally. This is resolved when using --shallow, which explicitly fetches the ref from the remote. I think this should probably always be done, and has nothing to do with a shallow clone?

https://github.com/ros-infrastructure/vcstool/blob/de18e196396e5d7d3dda75ad92304f8e22352c30/vcstool/clients/git.py#L315-L341