Bear in mind that as mentioned before this is an advanced caveat emptor feature (so users are expected to have to think what they are doing as it comes with a set of advantages and disadvantages) but just to be clear: security-sensitive tools like pip can and should disable laziness right at startup with sys.set_lazy_imports("disabled") (or install a filter that forces eager imports). That way the environment variable can’t affect them. The with trick would work too since those imports are always eager, but it’s potentially suboptimal compared to just turning off the flag once at the beginning.
5 Likes