It sure does work like that.

Our package managers have in-house mirrors, only validated dependencies by legal are allowed on those mirrors.

Installing in 30 seconds is not allowed by design.