My point is that large Rust projects end up using hundreds of transitive dependencies that indirectly touch user input, and certainly some of them have vulnerabilities (memory safety isn't the only vulnerability class - it's just low-hanging fruit for LLMs), and any could become malicious.
Log4Shell wasn't a supply chain attack, though; it was a genuine bug in a widely used library that had become a de facto standard, even in an ecosystem that tends towards relatively smaller and shallower dependency trees. So that comparison doesn't seem apt.