It would make it easier to, as a matter of policy, to stick to components from teams like boost or Apache or Google, i.e. groups with known reputations, reputations for having long-term, active involvement and maintenance than crates put out by single individuals or startups. And if and when a project was compromised, it's more likely to be discovered in a timely manner.
To build reputations (good or bad), an ecosystem needs branding--a reliable way to connect products to an identifiable group with a history. Reputations are crucial if you're just downloading blobs of code in a fast-paced environment, because you're not directly analyzing the code, certainly not every update, and usually not even initially. It's why you don't download software from random websites to run.
Linux and BSD distributions that packaged code were trusted (to varying degrees) to vet code through their package maintainers. People apt install packages with m
less trepidation and risk than if they pulled random code off Github. The distro reputations tell you something, at least something much more credible that what availability on crates.io and github.com tell you.
Technical security processes, which are also lacking, are no substitute for social processes. They're complimentary; you need both. But the most rudimentary and important prerequisite for building more secure social processes is completely absent in the Rust crates ecosystem.