> The project could have pinned the version and downloaded from pypi rather than repackaging.

It couldn't, since Nix is a package manager and will only download things from its repository. It can't access the internet otherwise.