There is also not too much legitimacy to the fact that Rust packages can run unsandboxed when they build themselves.

I feel like it's harder to hide malicious stuff in Rust build scripts.