Part of the discussion is release flexibility vs predictability. My main problem is that currently we have neither. By default CLI downloads pinned versions of platforms but latest versions of plugins.
Changing the concept of corodva project to something managed by npm is an interesting idea but it requires much much more than just adding a package.json file and is not a short term thing. I think it deserves a separate discussion.