I think crates.io is essentially just the default, and you can point cargo to an alternate package repository, if you so desire.

I've worked on projects where we vendored all third-party crates, for example, so our config just pointed to that vendoring, and I think support ought to be better these days…

I mean... it technically doesn't? You can always point to other registries (or you can even just pull in git repos), we literally do this at work.