Image provenance

Knowing where an image came from and what produced it is a different question from whether it has known flaws.

Provenance answers whether this is what you think it is. Scanning answers whether what you think it is has problems. Both matter and organisations usually have the second and not the first, which is why substitution attacks are harder to detect than vulnerable dependencies.