Yea I get that. To me this scenario gets mitigated with due diligence checking when spinning up a virtual machine - but I recognise the benefit in having a single artifact.