I fully agree. I worked on systems that are not connected to the Internet for security reasons and receive "offline" security updates using distribution package

I fully agree. I worked on systems that are not connected to the Internet for security reasons and receive "offline" security updates using distribution packages. It's also very common in security-sensitive environments to give blanket approvals to specific distributions and prohibit cowboy deployments. (I'm not sure why you are replying to my post)