If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform.

Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date.

Why couldn't that work?

I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust.

And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI