I fully agree. I worked on systems that are not connected to the Internet for security reasons and receive "offline" security updates using distribution packages.

It's also very common in security-sensitive environments to give blanket approvals to specific distributions and prohibit cowboy deployments.

(I'm not sure why you are replying to my post)