You want to go statically link your internal rust binary that you are pushing out to hundreds or thousands of nodes and you need the extra performance? Go for it, you can handle rebuilding it every time there is a security update (and last I checked dylib's allow both static and dynamic linking against them, so you have that option). But if you want to include your binary in a distribution package repository it really should be dynamically linked, tracking what dependencies everything has and forcing rebuilds and updates for EVERY SINGLE BINARY that uses them is wasteful and a pain to manage.
[1] https://fedoraproject.org/wiki/PackagingDrafts/Go#Security_i...
I can't say anything about the build tooling other releases use (I only have real experience with Koji and a limited look at OpenSUSE's OBS), but I don't think (m)any support "rebuild all that depends on this package" without manual intervention. It's really a crappy situation to be put in by language designers who value their use case over all else, and while, again, I think static linking can have a place it really doesn't belong in distribution repositories if it can be helped.
To elaborate on the parent's example: a particularly bad bug in a library depended on by a set of programs might not cause much of problem if you build and deploy this software yourself.
However, it would be a more significant endeavor on both the distribution's part (recompile, repackage, sign-off, and release every program in the set), and on the user's part who has to download the large binaries each time a dependency is updated rather than a small library. This problem is further exacerbated by the npm-like dependency graphs rust programs tend to end up with. Take servo as an extreme example of what these graphs might look like: https://web.archive.org/web/20160703132700/https://dirkjan.o...
Furthermore, I don't see how dynamic linking prevents the compiler from optimizing the resulting binaries. C libraries have been dynamically linked for decades without issue.
Updates in Fedora sit in updates-testing for a week unless the package gets enough karma from users testing the package, there's a fast track for certain security updates but having to push dozens of packages that depend on a library through this is a giant pain and causes a huge headache. With dynamic libraries we can just update the library, get it through the testing phase (and if necessary fast track a single update) and move on with life.
As far as the GP's point about optimization, rustc can inline a lot of code from linked crates if you are compiling statically, which in tight loops can be a very useful performance optimization due to not needing to spend cycles on setting up a new stack frame and calling the function. However, like you say, applications written in C/C++ have used dynamic linking for ages and it is usually quite rare to need optimizations this deep - if YOU need them for your application please feel free, but in general dynamic linking should still be preferred.