I'm not the parent commenter, but I'm sure they know that. I think their point is that the image which a tag refers to can be changed in the repository, so if

I'm not the parent commenter, but I'm sure they know that. I think their point is that the image which a tag refers to can be changed in the repository, so if you're concerned someone might generate a Git commit with a colliding hash and produce another build with the same hash, there is in fact a much simpler attack scenario: replace the container image in the repository with any different image with the same tag. The syntax they provided identifies the image by its own hash, so producing a different image with the same hash is _much_ more difficult.