Not sure what Docker Hub has, but as sys admin you can pin to a specific 256sha, so that specific image can’t be taken over. However that conflicts with the idea of just running Watchtower.