which has existed for much longer than has crates.io
The Rust compiler has not existed for as long as the debian package manager has. You're still trusting it and its standard library even if your reason for trusting it is that Debian's maintainers trust it. This is also true of any vetted dependencies you download. You're trusting others at the end of the day, whether they are the package developers or the auditors. Only by auditing your dependencies yourself can you avoid trusting anyone else.
With that being said, you are also able to contribute here. Someone has to do the auditing. Go audit some packages!