That's not always possible depending on your environment; I've worked in regulated & federated environments where teams didn't have the ability to create custom images and were forced to do at-boot provisioning. Additionally, at-boot provisioning reduces overhead of having to maintain both an image and your configuration, meaning less up-front work for SRE teams.

I'm curious as to the reasoning for never using remote-exec ; are you saying you should never use it because of some other process that negates it, or that there's some technical limitation that makes it unreliable, etc. ?