EXACTLY. It’s just software. There’s no easy answers here. There’s vulns in everything from hypervisors to node modules. Building from scratch isn’t going help.

Pragmatic solutions where possible. Like scanning containers, using OWASP tools on your repos etc