Usually it is quick, it is a single http fetch. It is pretty static, doesn't change often. 

This is really checking for existence, not freshness. If this package list does not exist, the install will fail. (Unless source is specified, and then again if it needed dependencies...)

I would say there is precedence for similar things here:
https://github.com/puppetlabs/puppet/blob/master/lib/puppet/provider/package/pip.rb#L59
https://github.com/puppetlabs/puppet/blob/master/lib/puppet/provider/package/portage.rb#L22