Does that mean that any Rust program compiled with any affected version of the standard library is affected?

Most programs don't use `remove_dir_all`, and a smaller fraction of those use it on a directory that untrusted actors can write to.

But yes, tracking down those that do is a challenge.