Why do you prefer using ``pip`` despite ``pip install`` using the package's ``setup.py`` (and therefore is an eval)?
Further, if you're using a package manager, I expect you won't be combing through the source to check for malicious code anyway.
This is also why wheels (the new python package format) use a static file instead of setup.py. The Python ecosystem has been trying to get off of "just eval setup.py" for years.
You have just ignored the point that your parent point was making. It's not the install case that they were complaining about.