I can’t see that it’s been mentioned yet, so I want to raise that even though
subprocess.run(t"some_command {message_from_user}")
is an excellent use of t-strings, it is inadvisable to claim that it is “safe on all platforms” without qualifying what “safe” means.
In particular, there are all sorts of exploits that take the form of setting message_from_user to something beginning with a hyphen. Depending on the exact command, you can do more or less with this. The usual solution to this is to write
subprocess.run(t"some_command -- {message_from_user}")
instead, but this can’t be done automatically, as whether this is correct or not will depend on what some_command is.
At the very least, this should be noted in the Security Implications of this PEP.