I agree. This goes back to the recent post "don't use latest". If you don't pin everything you can't claim that VCS is truth. A built binary is the truth, whether that be a container image, go bin or whatever. Even then I wouldn't say it's the absolute truth. The whole system is the truth.