Yeah, that is expected. Their release cycle is way longer than ours + somebody would have to maintain such deb package and keep it up-to-date.
So anyway you have to either wrap it yourself or use virtualenv which I recommend. For deb package you'd need to also make sure you have all proper dependencies packaged/available.
If you go for virtualenv, I recommend you having a constraints file which you can enforce using `pip install -c constraints.txt`. Make sure to add dist hashes to that file. You can generate that using pip-tools.
Oh and to have a reproducible deployment use smth like Ansible.
Another way to isolate your app env is to use docker, you may want to consider using it.