> Its hard in rust because any code you pull in can always drop down to unsafe, and in unsafe land you can really do whatever you want.

Not super familiar with Rust, so this may be a silly question: could Rust mitigate this by forbidding third-party packages to use unsafe code, except for ones you specifically allowlist? e.g. your Cargo.toml might look like this

    [dependencies]
    trusted = { version = "1.0.0", unsafe = true }
    untrusted = "1.0.0"

The trusted library would be allowed to use unsafe code, but the untrusted one would not.