Not only do you likely need to populate your host with packages not from your host. But also, your host will also still be connect to a public net, even if only indirectly (e.g. private net), and hence potentially manipulated.
No, you misunderstood what is actually the problem here. Pulling under
deployment some code from random resource from the internets that can go down
or get deleted at a whim and you can't easily move to just some other mirror
and you don't even control when the thing will be up back, that's the problem.
Not the trust you need to put to use the code (this is still there,
obviously). And the very same comment applies to third-party package
repositories, like PPAs in Ubuntu.
Not to mention that with pre-built binary packages your deployment speed and
repeatability get significantly better, as you don't need to rebuild the
artifacts every single time.
Not only do you likely need to populate your host with packages not from your host. But also, your host will also still be connect to a public net, even if only indirectly (e.g. private net), and hence potentially manipulated.