I assume that it is harder for Rust, because it needs to deal with `features`, with cross-compilation, with the developer using `nightly` for some projects, `stable` for others, pinned versions for yet others, etc.

That being said, harder doesn't mean unsolvable.

Maven and CPAN did it first, and in many ways better than node.

Node supports circular dependencies and arbitrary pre/post-install scripts, which are both disasters for downstream packaging. Node is not a model here.

The CAS that gets symlinked into vendorized directories à la pnpm is the Nix model, which is indeed an improvement that other package managers which support vendorization should incorporate.