It's weird seeing this sentiment when Sergio is on matrix answering questions all the time and the contributor graph for alternatives like Axum is basically identical, one person making all the commits, another person doing a fair amount of work, and the rest are drive-by PR's.
Seems more like an entitled open source user issue rather than a repo issue, he's never slept on any security notifications as far as I know.
The 0.5 release was a big re-write, it takes time. I likely will still use 0.4 in future because not having to mess around with async is nicer and it's still perfectly fast enough for many usecases.