In my last role rg and jq were included as part of our standard AMI as well as our base container images. It broadens our CVE exposure but it was undoubtably worth it.