Python package version resolution is a Turing Complete problem and installs are not deterministic. Securing the ecosystem is going to be serious work.
Oh it _absolutely_ is!
We're working extremely hard here and I think we're making great strides. More hard work to come, but I think it's absolutely worth the effort!