This hits the nail on the head.

Some crates, especially things like data structures, are just “finished” at some point.

Then again, if those kinds of crates have deps, the deps should be updated semi regularly.

Its good to use cargo-audit to find indirect security/safety issues.