That makes me think - would it be possible to have a runtime or build time option for cpython that removes eval() ?
It seems you can’t run bandit on deps, but perhaps if you fork them and build yourself?
If you are security conscious, having a rule that you can only install from a local pypi with packages you have forked would be a more defensible perimeter. But, a maintenance pain for sure.
My favorite case was when a newbie coder used eval() to evaluate something that looked json-ish, which, came from an api request.