Personally I'd consider it an "ought to" for all languages.
Java's maven & gradle might offer the illusion they don't do it wrong (debatable, I consider anything other than source distribution to already be wrong), but they do that by making the initial clone of a source repository an externality outside of their scope and assume the programmer did the right thing before building & uploading the artifacts which they then download over HTTPS.
The same issue applies to basically every other language with automatic dependency resolution. Making it an externality doesn't make it any less of a problem, it just means they wash their hands of it.
