The go list -m all command:
$ go list -m all |grep rsc
rsc.io/pdf v0.1.1
rsc.io/quote/v3 v3.1.0
rsc.io/sampler v1.3.0
But my project does not depend on rsc.io/sampler
$ go mod why -m rsc.io/sampler
# rsc.io/sampler
(main module does not need module rsc.io/sampler)
Because rcs.io/quote/v3 depends on it.
By pulling in a dependency, you in turn pull in all of its dependencies.
As for the main module does not need ... line, this is explained in the go help mod why help text:
If the package or module is not referenced from the main module, the stanza will display a single parenthesized note indicating that fact.
When the information from go mod why seems incomplete, try go mod graph for the full dependency graph.