It was mentioned here: PEP 750: Tag Strings For Writing Domain-Specific Languages - #196 by jimbaker
And has been discussed in some depth starting here: PEP 750: Tag Strings For Writing Domain-Specific Languages - #207 by nhumrich
With a resolution of this subdiscussion AFAICT at PEP 750: Tag Strings For Writing Domain-Specific Languages - #226 by dkp
The final resulting note in the rejected ideas section doesn’t mention security concerns: PEP 750 – Template Strings | peps.python.org
It also doesn’t distinguish between implicit literal-only and explicit concatenation.