Yes that's exactly what I did.

I have a docker image with a given version of Hugo and I've been using it for years now.

That's the beauty of building HTML: you don't HAVE to stay up to date to get security fixes.

Is there a reason for OCI images? It is just a binary? I have all used versions in ~/.local/bin/

  ~/.local/bin/hugo0.145.0
  ~/.local/bin/hugo0.148.0
  ~/.local/bin/hugo0.149.0
  ~/.local/bin/hugo0.150.0
  [...]

and a convenience symlink ~/.local/bin/hugo, pointing to my "production" version. I can easliy call whichever version I like with hugo<tab><tab>. What am I missing?

It depends on your workflow I guess, but the advantages of having a Hugo version tagged in an image:

  - sharing it easily between computers/users (docker pull registry/image:tag)
  - having the appropriate binary version embedded in your code through a docker-compose in your repo
  - having custom aliases dedicated to hugo included (build/serve/run...)
  - using the exact same image in your CI/CD
  - not "polluting" your local computer with some more stuff

> Then when I wanted to update I rewrote my whole theme from scratch

I think that's what OP complains about here

Good idea, sounds like the only sane way to use it.