While composer does have this limitation in that packages are published by making new tags within the repo, frameworks like symfony and cakephp have workarounds

While composer does have this limitation in that packages are published by making new tags within the repo, frameworks like symfony and cakephp have workarounds where they have one monorepo where all packages are worked on, and then automation to push changes to read only repos of each component. So there's https://github.com/symfony/symfony https://github.com/symfony/symfony pushing to https://github.com/symfony/event-dispatcher https://github.com/symfony/event-dispatcher which gets published to packagist.