Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm
This of course raises the question: what if someone puts some malware in a crate?
Do decentralized web of trust schemes actually work? What are the precedents? AFAIK, only centralized webs of trust work, and even those still leak around the edges and take some degree of active policing to defend. Basically, someone (or maybe a few competing someones) with authority establishes a canonical boundary and publishes a canonical list.