Hat Trick: AWS introduced same RCE vulnerability three times in four years

Interesting read. But I wonder, does pip not have some way to force installation from another index that would work as expected?