I agree, I think if you're going to deploy an application that's facing the internet, it makes sense to take the time to roll the deployment scripts (Salt, Ansible, etc.) and understand at some level what is getting installed, as well as how it's configured and how what needs to be setup for security, rather than just trusting the image.