Do you not patch your docker images against CVEs?

Started using a Docker Manager (Arcane) with built-in vulnerability scanning (using Trivy) which is also able to automatically patch docker images (using Copacetic/Copa). I'm frankly astounded at the number of vulnerabilities it found in just the small handful of containers I'm running. The worst offenders are Immich, with 745 vulnerabilities spread across 4 containers, and Nginx Proxy Manager with a staggering 1,420 vulnerabilities.

I tried patching a couple non-essential containers (iSponsorBlock and Scrutiny) just to familiarize myself with the process in case I broke anything. It's manageable, albeit a little cumbersome. But I'm scared to try patching system critical things like NPM and Immich, for fear of breaking things.

I'm just surprised that this isn't talked about more. Are people just out here raw-dogging their docker images and that's normal? Or is this a non-issue and I'm worrying about nothing?

https://redd.it/1x6x5c0
@r_SelfHosted