Build scripts are a lot scarier than proc macros to me. Those get run if you simply add the package as a dependency and build the project, even if you haven't used them in your library yet at all. And nearly every ecosystem has build scripts that can run entirely arbitrary code.