Comment by feinte

The problem lies in baking entire distribution into an image.

Using distroless images or "FROM scratch" with statically compiled app reduces the risks.

You still have to watch for your app dependencies updates but that's less work than for an entire distribution.