[esonderegger]

To me, it comes down to whether the deliverable is the source code itself or the process by which the source code is created.

If the deliverable is static html, for example (it often is), then it shouldn't matter if that static html is authored in Eclipse or Sublime Text. By all means, the dependencies used in java projects should be scrutinized. The problem is, when it is too cumbersome to even experiment with something new from the open-source community, you end up trying to create your own in-house solution, which is way more expensive and usually less secure.

Fortunately, even top levels of management have recognized this problem. Virtual workstations are just one of a couple proposed solutions, but it's a serious option.