Well other package managers don't automatically update packages like NPM does though but pin the exact version that you installed.
I mean it doesn't even really have support for proper package versioning, instead it just magically hacks the environment. Which happens to work, but is also kinda a nightmare.
I have no idea why python programmers still mostly accept that as a viable solution.
Short of downloading individual jar files without the original source code.