Standards and requirements will change, bits will rot, and im not expecting any ecosystem, to keep up with comming and going demands.

A better solution imho would be project level capabilities, so you can pull in a dependency but restrict its lib/syscall access, so it would not compile when it turns malicious.

Maybe it will solve at least something, maybe some day.