I would infer that it's insecure, since if it were that easy there wouldn't be various abandoned projects trying to sandbox Python.

It's the curse of any sufficiently useful language. Well, maybe not Lua, but that was specifically designed for embedding. Java also began with that intention back when applets were ahead of their time, though IIRC secure sandboxing is no longer really a feature.