> Also the challenge of building a generic module is much larger than building your own. A generic module needs to have flexibility for many different options and integrations, when you build your own you build just what you need and tightly integrate it with the product
True but I believe overestimated. Usually rather than building what's needed, what gets built is what is thought to be needed (often a substantially smaller subset), and then over time you end up building a markedly poor version of a generic module.
I think that even for core modules like an http server or client, but that's not the case and we don't need to get into that debate.
let's look at the actual package from OP
>https://docs.rs/arrayref/latest/arrayref/
>This package contains just four macros, which enable the creation of array references to portions of arrays or slices (or things that can be sliced).
I'm no rust programmer, but that doesn't sound like something that moves the needle. I talked about the ratio between value to risk being a relevant decision parameter, so getting infected by an http framework would be defensible, getting infected by adding this to a project to me is a PIP, and getting infected by installing leftpad or a custom cursor plugin in an IDE would be fireable.