I guess it's give and take - on one hand containers would isolate processes such that a security bug in an application shouldn't allow an attacker to propagate

I guess it's give and take - on one hand containers would isolate processes such that a security bug in an application shouldn't allow an attacker to propagate to the rest of the system. On the other, updates are not centralized anymore as you pointed out. Then again, the most commonly used distros have a slow update cycle anyways, so I don't think it would change that much if they rebuild container images rather than packages for each release. Plus, isolation would allow software to be tested independently from each other, so rolling distros could become easier to handle for the maintainers and more stable. IMO from a development perspective it makes sense as a step forward.