Here’s a somewhat contrived “attack”: I write a crate with two functions that are named similarly, wait for you to integrate it, then file a pull request using the Unicode function name (and hence calling the malicious function) and be relatively assured that if you looked up the function you’d stop reading code at the ASCII one.
The code published on crates.io does not need to match the code in your github repository, so... you don't need unicode homographs to do this kind of attack.
