My point is that large Rust projects end up using hundreds of transitive dependencies that indirectly touch user input, and certainly some of them have vulnerabilities (memory safety isn't the only vulnerability class - it's just low-hanging fruit for LLMs), and any could become malicious.