yeah that's basically my point. People who maintain crates don't work for me and it wouldn't be reasonable to assume any kind of responsibility for keeping my stuff secure, unless there was some big fancy standard library or runtime pushed by a major corporation or public figure that was committed and capable of doing so. So I implement my own rust libraries (just the parts I need, mostly asking agents to do it) because it's the most cost effective way for me to trust my supply chain.

But I wouldn't have to do that as much in languages with larger standard libraries or more established libraries/tools/ecosystems (eg abseil in C++, numpy and tensorflow in python).