Second, the target system account must be configured to be passwordless

Finally it pays off to use my birthday as password

The Docker Hub base image for Alpine has more than 1 billion downloads.

Okay sure... but most docker images that are using alpine aren't running an ssh server inside that alpine container. I can't say it's zero, because I'm sure someone is doing crazy somewhere, but I bet it's very close to zero.

The non-docker deployments are more legitimate targets, but this number here is basically useless for actual vulnerability, in my opinion.

so keys yes, and passwords no still good?