They care deeply about software security and memory flaws (everyone should). If rust had an ISO standard, then it could be used in more sensitive military and aerospace systems.
Something being an ISO standard has nothing to do with being able to send OFAC after you? Fundamentally the difference is providing a service vs an idea just existing in the ether. You can't sanction Rust, it's just an idea. You could tell rustup they can't allow downloads from IPs that match sanctioned countries.
https://www.stroustrup.com/JSF-AV-rules.pdf
Also, when something is an ISO standard, then governments can't legislate that some countries may not be allowed to use it.
https://help.duo.com/s/article/7544?language=en_US