“That’s because RUSTSEC is basically a rating agency and they decided that your debt is now junk.”
yaml-rust worked fine for insta for four years while unmaintained. Then RUSTSEC flagged it, CI broke across the dependency tree, and users demanded action. Ronacher vendored the code into insta and the warning vanished. The code is the same code. Security advisories that punish abandonment instead of bugs teach maintainers to hide their dependencies.