To be honest Rust has the exact same supply chain attack pattern - it's just newer and more maintained at the moment. Give it a decade.
Supply chain attacks are available to every language and framework that uses dependencies or modules you don’t control.
Programs in Rust (or almost every other language) normally have fewer dependencies by 2 or 3 orders of magnitude.
And that number tends to reduce even more when the ecosystem matures.