These packages could be composer-ized, and there is existing work to do this (but it is probably out of date). Recently (CRM-18408) we were affected by bugs addressed upstream in Net_SMTP because our version of that package dated from 2011 and lacked modern TLS support.
According to https://github.com/civicrm/civicrm-packages/pull/135, as of Dec 2015 the version of Net_SMTP was a "clean" version of upstream and so we could drop the version in civicrm-packages in favour of upstream.
https://github.com/civicrm/civicrm-core/pull/7361 suggests 1.6 was targetted as 1.7 did not support PHP 5.3, but above we pull in code from 1.7.3 I think. Net_SMTP lists PHP5.4 as a requirement, this applies from 1.7 onwards.
By way of CRM-18408 PR182 we actually would patch Net_SMTP to load in our own CA certs. I don't know if PR182 is required though (affected sites tested OK when PR184 only was applied, details on that ticket).
cc Tim Otten