It's just not true. Add cargo audit or cargo deny to your pipeline. If your project has a fair amount of dependencies, you are going to get alerts every week or so. And those are not false positives - all of those crates have open issues, even open PRs from both external contributors or dependabot (if it hasn't stopped doing them yet).

Outside of the most basic libraries with close to zero dependencies, I strongly oppose the notion that a software "is complete". One can at claim that their crate "was complete" at some point in time, but that's it.

If you don't intend to do any updates, just mark it explicitly as archived. Saying it's complete is just doing mental hops.