You're absolutely right, except you're wrong because today, developers have the habit ingrained in their skulls that production servers should download code from 3rd-party servers.
It's in the bloodstream now, there's nothing anyone can do about it - except the miscreants.
If they create enough mayhem, bloodshed and tears to make all CTOs and CIOs scream for keeping production server code under control, then we might get back to those hallowed times when an admin actually knew what was running on the server he was responsible for.
But, these days, the mantra is "move fast and break things" and, boy, how we are setting ourselves up to be broken . . .