So the problem here is that you can inject code into a system python process because they run with the user's python install location on their path.

They've fixed the wrong "root cause".