The problem ISN'T the lack of caching
No, no, no, the underlying problem isn't that big organisations don't do local caching of the repositories - adding proper caching would be a superficial fix.
The problem is the dumb mechanism where software loads it's "live" system from non-bundled third party libraries in the first place.
The auditing disaster of NPN, rust, go, and others is the fact that they encourage a writing philosophy where just about everything is a third party library, so you end up with simple programs loading thousands of piddly library files whose comments are larger that the code.
The security and reliability disasters on top of this bandwidth problem are with the systems (NPN, and others) that encourage projects to download these files fresh not at compile time, but at runtime.