Having code running in a container is still harder to exploit than just having full ssh access to the boxes?

I am not a security expert by any means, and this workflow was not created with security as a priority in any means, but the latter still rubs me in a worse way. It might be just an ignorant hunch though.