The lockfile confusion/bug is indeed a thing, but OP is noting that b58 was downloaded, which makes me think it's actually used.

I ran in to the lockfile bug myself a day ago and noticed that dependency-feature-flagged-crates show up in Cargo.lock, but their crates aren't downloaded.