Supply-chain-attack risk

As far I know Google and Mozilla actively use vet and routinely audit crates, and some other ecosystems (eg Gnome) at least plan to. For non-commercial projects it's always a matter of resources tho, auditing 3rd party code isn't exactly fun after all, not something that folks enjoy doing in their free time. Ideally, someone like Microsoft who are apparently using uutils in one of their products would work towards vetting the dependency tree.

That said, I believe that adding cargo-vet to Rust project is universally a good idea, even if dependencies are routinely exempted. At least it makes the cost of dependencies visible, and helps to separate the big and trustworthy crates (eg libc, rustix, Tokio, etc.) from small. little know dependencies which need a closer look.