govulncheck analyzes symbol usage and only warns if your code reaches the affected symbol(s).

I’m not sure about cargo audit specifically, but most other security advisories are package scoped and will warn if your code transitively references the package, regardless of which symbols your code uses.