All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient.

So why should I download images from a 3rd party outside of the Fedora project?

All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want.

If you really want to harden an OS with a good SElinux implementation you should try enabling user roles.

Agreed, that would be a massive improvement. There's a SIG upstream working on it.