It is obvious to me why rubygems was used, when the data was public: their firewall had whitelisted connections to package repositories like rubygems, npm, PyPI

It is obvious to me why rubygems was used, when the data was public: their firewall had whitelisted connections to package repositories like rubygems, npm, PyPI, etc, so they used those sites to proxy to their destination.