So, don't add dependencies before you audit the code? That seems like a pretty reasonable ask to me.
> Asking the user to not make mistakes is the c++ approach to security
Then demand crates.io do better by actually curating every version of every published crate.