The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.

It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.

What we need is actually sandboxed dev environments.