I’m not against language-based security, proof-carrying code, and all that, but I have less than perfect confidence that the Rust compiler currently is or will soon be sound enough to be secure against actively hostile code

Yeah, rustc currently does not claim to be resilient to hostile source inputs. Those are bugs that need to be fixed, but they're not p-critical warranting a point release.