I agree. But imo these usecases are more known and mature in traditional setups, we could apt update and restart a systemd service and its done.

Its not so obvious and there are no mechanisms for containers/images.

(I am not into devops/sysadmin, so this might also be my lack of exposure)

There can also be old images with e.g. old openssl versions being used. Its not a concern if they are updated frequently, but still manual.