Nice to know.
Perhaps, in Linux, we can consider setting up a sandbox with restricted file access and a separate pyenv for each blend file.
Also, don't give Networking capabilities to the python script by default.

Would be nice to give this setting to the package maintainers and upstream itself.