This needs to be solved at the language level by defining whitelist-like contexts. Some sort of

  with MyContext(allow_sys_cmds=false, network=false, read_disk=false):
     ...

I've seen at least a paper trying to bolt-on such a feature on golang but it's way too convoluted. Of course this doesn't solve everything, especially for languages with magic/collateral effects like running logic on module import.