CNI plugin binaries are being pulled in three different places:
1 - In hyperkube-base: https://github.com/rancher/hyperkube-base/blob/master/Makefile#L30-L32
2 - In rke-tools: https://github.com/rancher/rke-tools/blob/master/package/Dockerfile#L25-L27
3 - CNI plugins include logic to distribute CNI plugin binaries too (not clear about Weave though)
We should investigate why but I suspect it is just a mistake. In that case, we should decide on one (probably 3), verify that things work and remove the rest