I think he mixes 2 aspects. There is security and there is reproducibility/traceability/reliability. For security using the latest versions of both base images

I think he mixes 2 aspects. There is security and there is reproducibility/traceability/reliability. For security using the latest versions of both base images and packages is typically a good thing. The cases that the newest package is more vulnerable since something 1, 2, 3 years old are not that common. However, if your process requires reproducibility/traceability (medical and other regulated domains) you cannot just deploy the latest and greatest. You need to pass it through some release process first. That should not be an excuse to run outdated, vulnerable software though. The same holds if you require high availability. Even if you might not need to document what you are using, you want to test whether it causes performance issues (zero performance is the worst one...).