Indeed that doesn't seem surprising.  It's like saying most debian iso images available at http://cdimage.debian.org/mirror/cdimage/archive/ have security issues.
Ofcourse they do if you don't run "apt-get -y update && apt-get -y upgrade" on them.  A typical Dockerfile will start with apt-get -y update && apt-get -y upgrade.