You're creating a strawman. Don't run cargo update without verification, duh.

> Asking the user to not make mistakes is the c++ approach to security

Then demand crates.io do better by actually curating every version of every published crate.