With custom OS content, it is possible that admin can layer extensions like usbguard  with version x while also using MachineConfig to apply usbguard which has version y. This can lead node to go degraded when applying custom OS content.

Similar behavior will be seen when RT kernel gets applied via layering as well as MachineConfig KernelType field.

Currently, we are documenting our recommendation in product doc https://docs.openshift.com/container-platform/4.12/post_installation_configuration/coreos-layering.html but more robust solution will provide better user experience. Some options are preflight checks, MCO being more smart with handling content coming from osImage override and MachineConfig CRDs.