Nope, run ldd on cargo; it links to libbrotlidec.so.1. Via libcurl.

Aren't you glad cargo connects to the network whenever it feels like it? I just love it when my build tool does that.

There are 753 crates that drag in brotli this way: https://lib.rs/crates/curl/rev

The real killer is the oath crate. Basically every rust project using OAuth is vulnerable. That's 398 projects on crates.io plus who knows how many binaries (a lot of non-library projects don't bother publishing to crates.io).

Another scary one is "a practical HTTP client that is fun" https://lib.rs/crates/isahc used in 317 crates including sequoia. In case you wanted somebody to steal your private keys.