[snookerdooker]

Although I cannot assume, I'd at least hope that a "large company’s CI system" would cache the frequently encountered version(s) of a certain dependency :/

[metadat]

Not a safe assumption. They tend to only invest effort into caching after getting blocked.

As a concretr example, this is a common big problem for NPM, and they have to resort to blocking IPs and/or CIDR ranges.