My company has a policy that all software needs to be explicitly approved. That includes any software library, extension, or package from a package manager. Is it followed? Not in the slightest! Something I recently ran into: the Rust version manager 'rustup' is approved but neither the compiler nor the package manager have been approved. That's despite our core product having used Rust libraries through the C ABI for years. Madness!

so what exactly is the difference between binaries and scripts executing arbitrary system calls?

For the purpose of our discussion: None whatsoever. That's my point. Corporate IT mandates what they know/think about, quite often unfortunately without any understanding of the specific needs of employees (like parent).

I found it to be a better strategy to start from a prioritised list of risks and tackling the high priority items in an actually meaningful way. But I can see how that doesn't work at companies with >300 employees - at one point security just pushes for whatever they can get, disconnected from the true needs and relevant risks at the company.

Some of the NPM packages contain binaries.