Yes, see https://doc.rust-lang.org/cargo/reference/build-scripts.html.

I believe build.rs can do pretty much anything: https://doc.rust-lang.org/cargo/reference/build-scripts.html

That's both scary and sad :-(

Why? If you are using a crate, its code will be running in your application. Its not really any more of a concern if it can run code while building.

Yeah, but with binary packages you can add another lay of defense in depth, signed packages, signature checking, etc. It's not just about the original authors themselves, it can also be about attacks on the public repositories, for example.