Because it's safer.

If you've ever tried dealing with a 'new' sysadmin, who decides to install a new package, which has a dependancy on a module with a different version, and that breaks something else on the box, and you have to spend the weekend trying to track down what they changed, because they won't fess up.

(It was ~5 years ago ... the module that got modified was Net::LDAP ... I don't remember what triggered the whole thing, but somehow, the script that we used for automating account creation for a 35k user mail system just stopped working ... luckily, it was a pure perl module, so I grabbed the older version from the development box.)

Where is it safe to follow? Any time you're not replacing anything that's already in existance ... but that may not be a file rewrite ... if you have multiple module locations, something might find the newer module first. Luckily, in those cases, it's easier to recover.