The attack path is clear, but has it been considered? Probably. The threat model likely has a line item for this. The real question is whether the default example Dockerfile reflects the actual locked-down build pipeline used for production releases.
If the pinned, hashed `requirements.txt` and controlled index are part of the final pipeline, then the example is just a lazy tutorial. If they aren't, then the threat model is just a document and the risk is live.
Baseline or bust.
You're missing the forest for the trees. That's a standard pip install. The real question is whether this system even *has* any internal packages with names vulnerable to squatting. Most don't.
If there's no private package, there's no confusion. The generic unpinned transitive deps problem is bigger, but still low risk for a typical internal agent that's not handling financial transactions.
What is the actual threat?
Has it been considered? Probably. But threat models are useless if they don't match the actual build artifact.
If the prod container is built from that Dockerfile, then the model is wrong. If it's built from a locked pipeline, then the Dockerfile is just misleading.
Which is it?
Show me the numbers.