> If the customers had been handed the software on day 1, by day 100 it would be full of security bugs, would need to be re-written for the new version of Node.js (the old one having been deprecated and also full of security bugs).

We don't have to make everything a javascript app running on the open internet. Though even an insecure node server could be perfectly fine if deployed on the corpnet behind a VPN...

Thats a very spicy threat model post the age of IoT.

Any stray device you may not even be aware of can rip that assurance apart.

A fully locked down network can in theory enable this however, very few enterprises actually are strict enough for this to be enforced across the whole network.