Those aren't the only two choices.
We also have the classic example of PHP with numerous not safe stdlib ways to use mysql.
To me the answer is still to vendor your dependencies and don't be on the bleeding edge of updates unless you're willing to invest the time into validating them.
> We also have the classic example of PHP with numerous not safe stdlib ways to use mysql.
I think it goes without saying that emulating PHP is rarely a good decision.
Don't forget C++ where large parts of the standard library are unusable (regex is slow and unfixable) or soft deprecated (dont use iostreams for formatting, use std::format, etc).
No, I prefer what rust is doing. It suits a system programming language. Which is what Rust is.