I've never worked somewhere that didn't have an internal Artifactory with copies of everything.

Not doing that is unusual, and actually less secure. Do you think it's sane or secure for all of your builds to depend on downloading packages from the public internet?