> In this case even dockerized environments would allow you to redeploy with ease.

Not if the CIO mandated that your bare-metal OS hosting Docker has to run a rootkit developed by bozos.