Well it is only a useful point if you audit/analyse images anyway.

Supply chain risks is a serious subject but the fact you blindly update manually or automatically doesn't change a thing.

Many companies have cooldown policies - you can’t get a library or image or anything if it’s not been up for a given timespan. It assumes people will realize and publish updates within that period.

That, of course, in addition to scanning, validating, and all other sorts of paranoia, because only the paranoids survive.