Do you request a version tag or a hash? In principle Docker tags are mutable

As I mentioned, personally I request versioned tags. That's the level of specificity that I desire to prevent surprise breaking changes. There is nothing to preclude you from requesting a hash if you want, it works just as well.

Typically I am installing images from large, established projects whose release practices I can trust to not re-use an old version tag and slip in a breaking change. It's technically possible, but why would they do that? Unless they've been hijacked, then it becomes about security posture which I see as a separate discussion to this one about breaking changes.

Someone like the author, or maybe yourself, may not trust their software repository and want a hash like Nix's lockfile, which is totally fine. My point is that you can do that just fine with container images, so the author's statement is not the complete picture.