If those transitive dependencies are baked into the language runtime, how is anything materially different? You just shift the vector around.
The proposal ends up amounting to either shifting stuff around, or asking to other people to put in more effort? Into a project that usually doesn't pay (programming languages and runtimes)
Which by the way, asking other people to do stuff for free IS the attack vector, if you are the kind of dev or company that gets hit by these, your ultimate root cause is that your business strategy is using code without paying for it. No such thing as a free lunch, you will pay for it, among other things, with an increased cybersecurity risk.
Packages can release updates arbitrarily, while standard libraries tend to have longer release cadences.
It's also more difficult to put arbitrary code into an stdlib, because stdlibs are scrutinized better.
Also, it's harder for some random anonymous developer to gain push access to stdlib repository.
One of the reasons so much Rust code is in libraries is not because there are no people to write it (duh), but because putting these in std commits maintainers to keeping backwards compatibility and slows down included package's release cycle.