You’re conflating different needs.
There are cases where full reproducibility is not necessary, in which case only the project file with appropriate compat bounds is sufficient, to allow updating packages, and so on. This is an absolutely fine situation. This is probably your need, but not the only situation.
Then there are other cases where one does not want to upgrade packages for absolutely no reason, unless explicitly requested, perhaps because there is a pipeline which is known to work with a specific set of packages and you can’t afford randomly updating a dependency which would behave in a slightly different way breaking your pipeline without much testing. You probably think I’m exaggerating, but this is precisely what happened a few weeks ago when the PkgServer broke because an updated dependency disrupted the pipeline: Lock `nginx-certbot` image to known-good versions · JuliaPackaging/PkgServer.jl@9354aa5 · GitHub (this was outside of the Julia ecosystem, but that’s beside the point). In production runs like this, reproducibility isn’t overrated but vital. One would hope that new versions of packages only get better, but unfortunately that’s not necessarily true and mistakes can happen, in production people can’t afford taking the risk of updating packages nilly willy because you don’t care about reproducibility.