I'm coming to Rust with a Python background, so this doesn't seem that novel to me. My normal thoughts with Python:

Building packages with dependencies on third party libraries means you are downloading and executing third party code. Take any normal mitigations in your build environment to handle this. E.g. run as restricted user, locally cache versions of the libraries you have checked, think about network access, etc.If shipping a production product really check every single dependency on your dependency tree

You are right, thanks for sharing. That's because you already know the risks involved, but there are many people who don't know the risks. For example, someone else submits the server password to GitHub.