What about complex SPAs? Database drivers? Polyfills? TypeScript?

Pulling the source and compiling the package instead of pulling the package. Not much difference. Maybe slower build times but more secure and better builds.