Good point, I hadn't thought about the layer sharing. I measured it: an apt-get upgrade on top of cloudron/base:5.1.0 today is 136 packages and a 677 MB extra layer per image, so with 30 apps that really adds up. On top of 6.0.0 (5 days old) it's only 16 packages and 28 MB.
So for my 7 own apps the per-app upgrade is fine, but for the whole catalog it clearly belongs in the base rather than in every app. If the dated bases (like node-base:24-20260920) get refreshed regularly and apps pick up the latest one when they're rebuilt, the sharing stays intact and the backlog never grows big. The numbers above also show that the older the base gets, the bigger both the security backlog and the upgrade layer become.