If there's a CVE in tokio, the OS could theoretically publish a patched version of tokio and all apps that depend on that end up using the fixed code.

As it stands now, the OS needs to publish updated versions of all rust apps that depend on tokio.