I fully agree. I worked on systems that are not connected to the Internet for security reasons and receive "offline" security updates using distribution packages.
It's also very common in security-sensitive environments to give blanket approvals to specific distributions and prohibit cowboy deployments.
(I'm not sure why you are replying to my post)
Resisting creation of operating system packages, even for dependencies is silly, because doing so is not hard at all: all it requires is reading some documentation, but the knowledge gained can be reused over and over and over again for the rest of one's career. Learning different OS packaging systems is an investment which pays hefty dividends.