Ah the classic "do something to prevent outside organizations from having agency in your project" (pin dependency versions) followed by "delegate the agency to an automation because agency comes with responsibilities."

It reminds me of the github bot someone posted here at the beginning of the year (it was hard to tell if it was satire) that just automatically approved (not merged, just approved) PRs to get around some technicality in some (supposedly machine verified) infosec standard that required two human approvals on every PR.