Has there been any considerations for a threat model or security review for adding the data field?

Today, a manifest can be safely pulled, without concern of binary content. It's one of the great designs of the registry APIs.

A security scanner can evaluate the digest of the manifest, and verify if it, or the digests of the layers|blobs have been identified as having security vulnerabilities. This applies to any manifest request, where metadata was assumed to be safely returned.

The data filed changes this assumption. A manifest may be pulled for evaluation, and it can now contain binary data. If another exploited process is waiting to run arbitrary code, a manifest pull can now include exploitable code that wasn't previously

Just suggesting we should think through this scenario before broadly adopting.