Exactly, many of these reports are of the kind "your java Web app container has a priv esc vuln in sudo" which is irrelevant 95% of the time. Need some smart tooling to help comb through all that noise.
Security matters, even if it is apparently about unused parts in a complex system.
If.
Story Time: At a customer I've once seen all (web) applications in their docker containerr running with root permissions. I raised an issue but the devops told me this would be fine. They simply did not care about security.
They run all their containers on two rented VPS. They dockerized everything, also their mail infrastructure, etc.. This means: If anybody found the easiest remote code execution bug in their webpages, they immediately could take over the whole fucking company. Because root in docker = root on the whole machine. Think about that twice.