I agree that supply chain is a risk but I think you are creating a false dichotomy. There is nothing stopping us from having a small standard library and a set

I agree that supply chain is a risk but I think you are creating a false dichotomy. There is nothing stopping us from having a small standard library and a set of official - but optional - crates for common things like regex. This is the best of both worlds in my view.