In a situation where memory unsafety could put people (or the future of the company) at risk downloading random unaudited dependencies off of crates.io is obvio

In a situation where memory unsafety could put people (or the future of the company) at risk downloading random unaudited dependencies off of crates.io is obviously a no-go. Ideally downloading off of crates.io is a no-go during building anyway, since cargo can work with all of your external dependencies mirrored to a local filesystem or your own custom crate registry.