Rust doesn't do it, Cargo does. And it's only doing it until Rust reaches 1.0, by which time there will be a proper bundled Rust+Cargo installer. And it's downloading over HTTPS without disabling the certificate check, which is the least egregious form of this (and frankly, if you can't trust that your TLS sessions aren't being hijacked you have a bigger problem).
