Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak.

The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.

People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit.

You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.