No warning if Cargo.lock is out of date

> cargo new foo && cd foo
     Created binary (application) `foo` package
> cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 251 security advisories (from /home/wim/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1 crate dependencies)
> cargo add pest_derive
    Updating 'https://github.com/rust-lang/crates.io-index' index
      Adding pest_derive v2.1.0 to dependencies
> cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 251 security advisories (from /home/wim/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1 crate dependencies)

If I then run a command that forces a lockfile update, you can see that both the count of "crate dependencies" increases, and a vulnerability is found:

> cargo metadata --format-version=1 >/dev/null
    Updating crates.io index
> cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 251 security advisories (from /home/wim/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (21 crate dependencies)
Crate:         generic-array
Version:       0.12.3
Title:         arr! macro erases lifetimes
Date:          2020-04-09
ID:            RUSTSEC-2020-0146
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0146
Solution:      Upgrade to >=0.14.0
Dependency tree:
generic-array 0.12.3
├── digest 0.8.1
│   └── sha-1 0.8.2
│       └── pest_meta 2.1.3
│           └── pest_generator 2.1.3
│               └── pest_derive 2.1.0
│                   └── foo 0.1.0
└── block-buffer 0.7.3
    └── sha-1 0.8.2

error: 1 vulnerability found!

IMO cargo audit should follow the cargo-subcommand standard of performing a lockfile update itself if not passed --locked/--offline etc. but at the very least should tell the user if the Cargo.lock is inconsistent with the Cargo.toml.

> cargo audit --version
cargo-audit 0.13.1

Reproduce the mismatch using the shown cargo new, cargo add, and cargo audit commands, then compare the behavior with and without --locked or --offline. Trace how cargo audit reads Cargo.toml and Cargo.lock; done means it either updates the lockfile under the default behavior or clearly warns when the lockfile is inconsistent.