I don’t see why this development makes this more likely to happen compared to string concatenation.

The log4j fiasco didn’t happen because of Java (wink) but because of a plain invulnerable feature. I don’t think Rust makes that more or less likely to happen.