I dunno, your reasoning could also be applied to dependency management registries. It is not even only about cost, it is a lot of infra to set up authentication with every single external registry with every single automation tool that might need to pull from said registry.

Like, I get it, but it adds considerable work and headaches to thousands (millions?) of people.