Is it Firefox or Geckodriver, which creates "rust_mozprofile" directory

If you have a closer look at the geckodriver v0.18.0 logs closely you will observe the very first occurrence of rust_mozprofile occurs in the following line:

1504762617094   Marionette  CONFIG  Matched capabilities: {"browserName":"firefox","browserVersion":"56.0","platformName":"windows_nt","platformVersion":"6.2","pageLoadStrategy":"normal","acceptInsecureCerts":false,"timeouts":{"implicit":0,"pageLoad":300000,"script":30000},"rotatable":false,"specificationLevel":0,"moz:processID":5848,"moz:profile":"C:\\Users\\AtechM_03\\AppData\\Local\\Temp\\rust_mozprofile.OfFuR9ogm33d","moz:accessibilityChecks":false,"moz:headless":false}

This log clearly indicates that marionette is being configured with:

"moz:profile":"C:\\Users\\AtechM_03\\AppData\\Local\\Temp\\rust_mozprofile.OfFuR9ogm33d" 

And this configuration is done by the WebDriver instance i.e. the GeckoDriver.

It's the GeckoDriver which internally configures the Marionette which in-turn initiates the Mozilla Firefox Browser.

IMO, this workflow is in practice since we migrated from the Legacy Firefox to Marionette based Firefox. Hence the same must be the case with Geckodriver - 13 as well.

Update:

GeckoDriver as an application/exe file: