"Don't release software that can pull code from random services on the internet then execute it without making that configurable" has been standard since the internet was available, just about.

Vendor your helm charts if they are production critical. Vendor the docker images if they are production critical. Vendor the libraries if they are critical.

As an added bonus, you even help making a saner internet where you don't pull left-pad three billion times a month.