Defining a threat model means to qualify what sort of attacker you expect to face and what they are assumed to be capable of

Which is exactly what OP is talking about. 5 years ago if you were only trying to defend against script kiddies, using containers was good enough. But now you have to consider that script kiddies might find container escapes.