Consider something like PyPi and the way in which it will host Python packages. There's times with Python that you will not know what packages are dependencies

Consider something like PyPi and the way in which it will host Python packages. There's times with Python that you will not know what packages are dependencies until you actually download it (this you may notice is why Pipenv will take so long to create a lock file, it has to download a ton of packages, get our your network traffic tools and have a look sometime). So I'm fairly sure there are times where the reason you don't know the dependencies exactly is because they are in some form of being unknowable. Now you might argue that such systems should be re-implemented and as a generalized goal taken in isolation I would tend to agree (improving existing code including legacy systems is something we consult on in my company). But alas in existing systems you sometimes have to deal with non-ideal circumstances that were created with non-ideal package management tools (legacy python and c++ being prime examples of difficult areas to get 100% right).