> I still don’t like that it’s possible to run arbitary commands on a user’s system just by them pip installing a package.

Is there a build system out there that doesn't have this feature? Pip is both a package manager and build system since many packages are compiled at install time.