Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these days, while also being basically impossible to audit every dependency you install. I’m a huge fan of good security shouldn’t impact too much on productivity, but dependency trees make me lose sleep at night (waterhole attacks, EOL packages that are painful to remove, etc).
Pentester by trade with a background in software dev.
I need $x.exe is not just a security risk, it's a business continuity risk. What is the licensing of $X, do we need to pay licensing for it? Are we getting sued for using it? Are we doing to redistribute it, and can we? In general the average programmer, especially on a team should not be making that choice, and someone higher up should before really expensive surprises happen.
I work in software composition analysis/static analysis/SBOM and ya, the average piece of software coming can be terrifying. Its common to see companies distributing things like open source packages in violation of the license. Even worse is when they are pulling in something like 'One-Js' and '0ne-Js' (made up for example) that shows up in audit of our SCA output.
But as you state there are many security models in which the dev machines still need to ensure you cannot leak code out of the company confines. In many financial industries leaking code between different teams can be/is considered a security risk.