For that reason many modules have options to set the packages used, so that you can eg. patch openssh without rebuilding everyone.