The problem isn't the language here, it's cargo executing build.rs from dependencies which necessarily allows arbitrary code execution.