At least with containers, if something manages to do damage, it will have to do it through a security vulnerability - which will eventually get patched if caugh

At least with containers, if something manages to do damage, it will have to do it through a security vulnerability - which will eventually get patched if caught. The current state of affairs is that malware can do damage without even needing to use a security vulnerability whatsoever. It's "working as designed", and will keep working forever.