I think it would be a good start if crates at least had to opt in to a build script, and adding one later would require permission from crates that depends on it.

The vast majority of crates don't need build scripts, so it is vaguely feasible to audit the list of crates you use that might need them.