How does this handle runtime updates if the source cpak Containerfile doesn't get rebuilt?

Right now on Flatpak, if I target org.freedesktop.Platform, when that gets security updates to libraries, my application will use them without needing to be rebuilt. I assume for cpak because OCI images are layered based on a fixed content commit, it won't get library updates unless rebuilt.

I do think Dockerfiles are a better mechanism than flatpak-builder specs, the ecosystem is huge.