> build from source or make their own images vs those who rely on provided images and upgrade them often.

I mean - this incident brings it into sharper focus - but it's always been thus.

As a Go developer I often tell people "Be wary of vendoring, you are creating a cache of dependencies that need to be managed and maintained"

Or people that "pin" dependencies, they face the same difficulty.

Why not just use "official" (in this case) images - sometimes they lag too - hell, most Linux distributions lag so much with Go compiler packages that, again, I routinely tell people to avoid them in favour of watching the Go official page