so very few use it

it's not made obvious that the tag isn't immutable

although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time

people inadvertently give full control of their build and all their secrets to whoever controls that repository (now, and in the future)

making it easy to do the right thing is an important part of API design and building secure systems, and these CI systems fail miserably there