No, this is not always the case. Regulated industries pin their package versions and store those versions for pulling.