biscuit_builder_build takes the builder argument by reference (Option<&BiscuitBuilder>) so it can't possibly free it.
(Contrast with authorizer_builder_build which takes Option<Box<AuthorizerBuilder>>, so it frees on exit by losing the reference.
IMO we shouldn't try to change the behavior now, but just document the difference; code that expects the current behavior would do a double free if we change it.