This is exactly the sort of attack this change is helpful for, as pip would not work at all on these machines. Probably the only way to stop these “social engineering” (as google characterized it) attacks.
The scariest part of that thread is the many people saying that closing your eyes and yelling "zero-trust" means that you don't need to protect your devices from compromise.