What’s alarming to me is not the marketing nature of the message, it’s the fact that you pull a container in its entirety. A container is not a single CVE. CVEs may be evaluated against the worst case scenario, but they’re not evaluated against each other. When you stack vulnerabilities you get difficult-to-detect sophisticated attacks. Not many ATPs I can recall rely on a single vulnerability.

Sure it would be nice to see some examples where chaining the CVEs from a popular image can lead to an actual attack, but I wouldn’t write off problem just because someone is marketing their product with it.