Why does Docker hub allow non-official Docker images and why do they exist?
As with most elements of Information Security, there is a balancing act between usability and security; an increase in usability often results in a correlated decrease in security and visa versa.

As a thought experiment...


  I can make any server 100% secure by wiping the hard drives, putting it through a shredder and then melting down all of the components parts.  It also makes it 0% usable.


Docker Hub is no different, the desire is to make these images accessible for the common good, at the cost of traceability and provenance of the images.  Fortunately, there are several tools such as JFrog Artifactory and Sonatype Nexus Lifecycle which enable you to apply governance to any Open Source repository (i.e. Docker Hub, Nuget, NPM, etc).

One aspect that I think Docker Hub gets wrong, that other sites get right, namely NPM, is presenting clear information about what Source Repository an image is generated from, that I suspect is due to the decoupled nature of Docker Images from the source code that generates them.