when it works for containers, it would have worked just the same for shared lib, but with one less step.
containers: update the lib, rebuild.
sane software: update the lib.
now, to the complicated case which containers claim to solve, when the lib update breaks compatibility.
container: update lib, application dont compile, leave like that because we think we are not vulnerable anyways.
sane sotware: update lib, application break, have to fix application because shared lib will be updated no matter what.
containers: update the lib, rebuild.
sane software: update the lib.
now, to the complicated case which containers claim to solve, when the lib update breaks compatibility.
container: update lib, application dont compile, leave like that because we think we are not vulnerable anyways.
sane sotware: update lib, application break, have to fix application because shared lib will be updated no matter what.