Probably they built their containers, wrote the containerisation sysstem, wrote all the libraries they were using, wrote the operating system, the CPU microcode, designed and built all hardware parts they were using.
You're missing the point. The official docker containers can be configured secure or insecure. Same with in house built containers. Same with installing an application via apt/yum/pacman/what-have-you.
You’re missing the point. That flag doesn’t matter; what does matter is whether the team understood what’s happening inside the container, or didn’t.