Hi Carwyn,
I would consider creating custom Ansible fact for this task.
But there are still some possible drawbacks
1) there can be lot of packages on machine (1900 on my laptop, 450 on random server) and you have to ask your packaging system (took ~0.5-2 seconds).
2) this long lost of packages and its version have to be transfered from target machine to your managing machine. It also needs some time.
So I would probably consider creating custom fact only for packages you are interest in - like glibc, openssl, and similar fragile components.
Have a nice day
--Věroš