Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.

Docker pull does not, so it will happily download a maliciously modified image, without checking.

You can go in the sun, but wear sunscreen. You can have sex with a stranger, but wear a condom. You can download software, but check the cryptographic signature.