It's not the big hammer that can't be argued with. There's a path forward there: bring in security experts to weigh in on this. This hasn't happened. It could, and when it does there may be progress.

Rust doesn't quite have a team for this yet (there's a security WG slowly spinning up though) which probably explains why it's kinda stalled.

Ultimately there's no obligation here for the team to do the legwork for this PR anyway. It's blocked on something, and while that's resolvable you can't blame the team for not pushing on it.

(I did just ping someone knowledgeable in security matters about this, let's see what they say)