What's the difference in how Codeception is installed?

Question

PHP

Take, for example, Codeception. The site ( link ) states that it is available for installation in two ways:
1. Phar file
2. Through Composer
In which case is each method preferable?

Answer 1

phar - stupid "all in one" file
composer - installation via dependency manager
we get:
1) The ability to update at any time with one command
2) Dependency resolution, i.e. 99% guaranteed no class name conflicts in the project (this can happen when the vendor in the project uses the same vendor as in the library)
BUT composer requires:
1) Internet connection
2) We rely on an external repository (packagist), in in case of its damage or pah-pah hacking, God forbid a virusnyga will fly to the project at the next update (this has not happened yet and most likely will never happen, but it all depends on the security policy of the project).