>Now we just build our stuff using wathever curated image is there that can be used and ship it without worrying about OS patches.

So you basically replaced the "we regularly have to update the OS" with "we regularly have to pull the newest image". It's possible because I have a Linux admin background but I don't see that big of a difference here. Oh and just using whatever curated image is there doesn't necessarily provide you with a secure environment. [0]

[0] https://snyk.io/blog/top-ten-most-popular-docker-images-each...