Last time I checked, installing some of the tidyverse packages from CRAN resulted in other packages being directly cloned from github and installed in the process. That sort of behavior really shouldn’t be allowed.
R packages on CRAN need to be able to install without internet connection so I'm skeptical that that's the case. CRAN packages also don't allow for dependency on R packages that are (only) on github.
I’ll try to look up details, but I’m fairly confident. I discovered it because I was installing packages on a server which was firewalled, and had the CRAN repository proxied.