The premise is that you don't want to audit the source. It's extremely costly and you end up doing it for every update.