I honestly think you're better off with RHEL. They might have been slow to act in this situation, but do one scan on a Debian vs a RHEL system container image and I'm confident Debian's will show a lot more red than RHEL (even with the fedora)

I remember RHEL being quite slow with copyfail as well. It'd be nice to have some more comprehensive statistics though.

And I don't put a lot of faith in container scans as a metrics. (More properly, I don't have faith in most containers scanners to properly identify package versions and backports.)