There are indeed other ways to manage the fresh install process. Not sure they result in less critical vulnerabilities overall. It is all too easy to never update ancient versions of installations, especially as server maintenance is often handled by a separate team.