> In the end it is your decision to use unaudited or refuse unaudited crates.

It should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.

If you want that you can always use vetted package repositories like Nexus. Many companies do.