Looking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the

Looking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the packages being transferred. Using the dependency tree would help in determining what packages have been downloaded. Though I admit this is a higher barrier than just reading the list of packages.