It’s absolutely mad and extremely entitled to expect that a volunteer group of developers do an order of magnitude or more additional work for no additional pay or benefits to themselves.

The core packages (things like rand and regex) are pretty closely audited in practice (albeit it might not catch a credential compromise).

This crate isn't one of them.

> Same people who keep the whole rust project going, a lot of those are volunteers aren't they?

Sure, but from my understanding the Rust project is generally "bottom-up" in that volunteers generally work on what they want to rather than submit their time into a pool for some kind of higher-level management to direct.