I do this occasionally. But it's because my company's security org has a ridiculous policy enforcing 0 CVE images for anything running on our infra (including internal CI images).
In some cases baking a dependency into an image is signing myself up for perpetual toil to keep the image CVE free.
In some cases baking a dependency into an image is signing myself up for perpetual toil to keep the image CVE free.