Another Drupal developer here, with some experience working with the Feds. Most government websites as I am aware of are Drupal websites.
Writing as a developer, I can tell you we are not allowed any access to live systems, which is good. That allows us to work in our sandboxes and break things before we commit to the GIT repository branch we're developing to eventually be merged into the main branch and released one day. In other words, the only connectivity we're allowed is uploading to the git server.
In a perfect world, we'd have resources including time to scan everything for everything prior to our GIT commit to the repo. I hear ai (and mythos) are a thing.
I'm just sayin'.
That said the NPM vendor directory is generally excluded by GIT, because none of that stuff belongs in the repo because it can easily be rebuilt on the staging server that gets tested prior to going into production. And the admins upstream aren't supposed to trust anything, period. In a perfect world.