I've noticed that crates can often include default features I don't want or need. If you don't include the default features ('cargo add --no-default-features rand' is what I did) then the only other crate pulled in is rand_core. I've gotten into the habit of reviewing the features and only including the ones I need. I don't know if there's a better solution that could be implemented somewhere upstream but this works for me.

Cargo has a vendor feature: https://doc.rust-lang.org/cargo/commands/cargo-vendor.html

Is there some language ecosystem that is better?

Before package managers you ended up with giant pseudo stdlib libraries like boost or eigen and you only needed a tiny piece but once you brought it over you had it all, and it had no sub dependencies to worry about. Monolithic was easier from a lot of standpoints. Crates.io is exactly what I'd want if I wasnttroo worried about safety or security. It is far more productive. But if you make software that other companies use to help make themselves secure, then you are wearing a bullseye these days and it is kind of your job to be paranoid about deep dependency trees.