minor nit: for Alpine's root, the * came with 3.16 in 2022, so that path is 4 years old.

the sshd/musl part dates to the 2016 CVE-2016-6210 fix, so other * accounts (key-only users, LDAP users) have been open for 10 years.

the website is amazing, I just think these details would clarify things.