You are correct that installing a wheel doesn't execute arbitrary code.

If you use `--only-binary :all:`, that is equivalent to --wheels-only. Though not all packages ship wheels