Because the working part of an organisation such as the one you describe tries to continually optimize away these restrictions. NPM (et al) is a good way to obfuscate the fact you're pulling unknown code to get shit done and processes haven't caught up yet.

I'm not saying this is good, but the reality with these company-internal restrictions is, that the most productive people find ways around them and are rewarded for it.