It really doesn't. Unless you were planning on doing a one-and-done deployment, it's trivial to update and redeploy Docker images. Even in my side projects I have CI/CD pipelines updating and redeploying Docker images daily.

> With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep.

Whatever you can do with Ubuntu, you can do precisely the same with Docker when running a base image of Ubuntu.

> With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container.

No, you really don't. Just pull the latest base image, build your images by calling apt to update your dependencies, and you're done.

Whatever you can do with a bare metal/VM install, you can do with Docker.

There is nothing magical stopping you from doing the basic stuff with Docker.