Debian, Rust, and librsvg

Where are the maintainers going to come from for all these application packages and the libraries they depend on that aren't already packaged, for each distribution? There isn't infinite volunteer bandwidth to package for every single project that any user might ever want to install. If the application developer(s) themselves have to be the packager for each distribution, then you've made "get your application in the distribution repositories" much more work than any other option for dependency management. You've also put trust decisions in the hands of the very people you didn't trust in the first place.

An application might not be packageable for policy reasons, because the distro isn't accepting new packages or the application is closed-source.

For platforms that don't have library package management (i.e. everything except Linux distros), "get your application in the distribution repositories" doesn't help at all with library dependency management, so developers need a separate solution for Windows/Mac/iOS/Android (usually "vendor the libraries"). Once you've vendored the libraries you may as well use them on all platforms.

Compared to the problems of C/C++ dependency management, fixing whatever security issues cargo has is easy.