There is also not too much legitimacy to the fact that Rust packages can run unsandboxed when they build themselves.