I wonder about the dependency graphs of all these replacement utilities. The vast majority of Rust projects I've seen pull in hundreds, sometimes even thousand

I wonder about the dependency graphs of all these replacement utilities. The vast majority of Rust projects I've seen pull in hundreds, sometimes even thousands, of external projects. If Ubuntu's rusty tools do the same, any memory safety gained would come with a greatly increased supply chain risk. Doesn't attack surface matter?