Very similar to how they are not part of the Linux kernel. It shows Rust can be used without it, but... it's so much of a regression for building systems compared to C.
huh?
For a developer, crates.io makes managing dependencies a breeze. For a user, they might just download a static binary, or a FlatPak, and they'll be happy.
But for system binaries? Those need to be part of a small base, with trusted dependencies. The crates.io model works against that; the massively distributed ownership of micro-dependencies makes trusting the security of your system almost impossible. Statically built binaries means that updating your system means re-downloading the entire OS on every security update.
The only solution to this is to ditch crates.io and vendor a small base of dependencies, the same way the Linux kernel does it, the same way Firefox does it, and the same way the Rust compiler does it. Using crates.io is really hard.