How is docker container, running a process as unprivileged user with reduced capabilities security disaster? With Kubernetes you can even have network policy or service mesh with mTLS. Compare it to bunch of bare processes running on the same machine, lots of services listening on localhost, difficult updates due to different dependency version requirements by different software, requiring you do the manual, painful update only once a year. It may look bad at first, but container can be far more secure that common non-container environments. It's always matter of configuration and maintenance.

It has a huge attack surface, also a lot of its code runs with high privileges. There's plenty of documentation on this.

How is Ansible a security disaster?

A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...

That’s not really a security disaster unless you consider all of SSH a security disaster.

If you are concerned about Ansible SSH’ing in (which means you are concerned about any person SSH’ing in), you just do the standard SSH hardening.

...and yet SSHing on a production system to make configuration changes is prohibited in many large companies including some FAANGs.

Because you (or some intern hired a week ago) are 1 typo away from making a disaster.

For the record, security includes availability and this is an availability risk.