Well it is only a useful point if you audit/analyse images anyway.

Supply chain risks is a serious subject but the fact you blindly update manually or automatically doesn't change a thing.

It does change a thing. Manually updating after a week after new version release has lower chance of it being a supply chain attack (it would've been noticed and fixed already).