Do you believe reproducible builds cover an important threat to make them worth the effort just for that? As far as I understand - not even a little. But the effort is much more important for the future of package management.