This is a very well-written explanation. The only exception is when people have access to the underlying container, willing or not. Then these vulnerable binar

This is a very well-written explanation. The only exception is when people have access to the underlying container, willing or not. Then these vulnerable binaries can lead to a vulnerable container. This is also why the subjectivity in CVE rating is such a significant problem.