Go downloading a toolchain is not any different to dustup downloading the version of rust that is in a toolchain toml file. At least with Go it will presumably only download officially released versions, and not gotip/nightly.
The rustup toolchain toml file is under your control, dependencies have no affect on it.
This Go feature is like the rust-version key in Cargo.toml where if a dependency specifies in it's own Cargo.toml file that it needs a rust version higher than you what you have you will get an error and your code won't compile (there is no option to auto upgrade the toolchain in rust).
A module’s go line must declare a version greater than or equal to the go version declared by each of the
modules listed in require statements. A workspace’s go line must declare a version greater than or equal
to the go version declared by each of the modules listed in use statements.
For example, if module M requires a dependency D with a go.mod that declares go 1.22.0, then M’s go.mod
cannot say go 1.21.3.