You know, I think this falls squarely into "obscure stuff you need to somehow know to not get correct-but-rubbish behaviour" territory.
Perhaps Cargo could learn to accept rerun-if-changed=* for the current behaviour, and warn when you directly build (i.e. not as a dependency) any package which both has a build script and doesn't specify at least one rerun-if-changed line.
Yes, but there is a reason of course: backwards compatibility. Your solution with a warning is good. Either way, we need to get this info out, so that it's being added everywhere.