Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak.
The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.
