Classic scapegoating. Or "not made here" type of stuff.
Way before AI, when I worked in somewhat-sensitive industry, my bosses wanted even smallest changes to the codebase be ticketed, documented, and reviewed for being malicious, leaving a paper trail for regulators. But pulling in thousands of NPM packages? Abolutely fine.