There are also better tools like Sysdig, Twistlock, etc. which scan containers at runtime for CVEs.

Sometimes build time is too slow (e.g., a repo that doesn't receive updates every day or so).