In order to support disconnected installs productization process requires using image digests (sha) instead of tags.

Work has to be done in operators and templates for 3scale and apicast self-managed to support that.

In both templates and operators changing to digests of fixed images implies that customers cannot upgrade the operands images automatically by refreshing imagestreams when there is a CVE for any of them.

In Operators, with OLM we can provide updates to operands images by creating new OLM operator releases. This means that for every CVE on one of its operands we should productize a new OLM operator release by productizing new operator metadata changes (do not confuse with operator changes themselves) . Also, at this moment with the current implementation operator metadata changes will not trigger an upgrade mechanism. A solution for thas has to be thought.
Additionally, the OLM update mechanism would not be possible when installing the operator manually instead of using OLM. The official way to provide installation with operators is through OLM but I explain this so we can take this into consideration too.

In templates the option of performing OLM updates is not available so it seems there's no possible way to do that by sha images so it has to be thought what will we do with templates.