My idea surrounding this is that we can use the new external deps ("bzlmod") launch and subsequent migration to our advantage.
So in the new world where repository rules are no longer a thing, we need to get rid of Bazel's WORKSPACE suffixes. A natural place for them to go would be into the rules_* modules. This would mean that, for a user to use bzlmod and e.g. cc_library, they would have to add rules_cc as a dependency, since that's where the local toolchains are defined, among other things. At this point it feels natural that the actual cc_library BUILD rules should be loaded from rules_cc as well. (This is of course predicated on the fact that we do eventually want to ship those BUILD rules separately from Bazel.)
bzlmod is definitely going to need some sort of automatic migrator script, to help people along with the migration even though it might not take care of everything. One thing the script probably needs to do is to scan all the BUILD files, see that there are cc_library/cc_binary calls, and automatically add a dependency to rules_cc. Then it could conveniently also just insert a `load` statement at the top of those BUILD files. Suddenly, it doesn't seem like so much churn anymore, since it's all done in one fell swoop!
So all in all, we have a path to an eventual "clean" world, with a way to mitigate the churn.