I still don't understand why this is considered a Python security problem.  If the user can put a malicious "python3.dll" at some arbitrary spot in the filesystem (e.g. a USB flash drive), and fool Python.exe into loading it, then surely they could put an arbitrary executable at that same spot and launch it directly.  And that seems way more straightforward.  Why would anyone bother with this?