Apologies, I didn't mean to imply PyPI was inherently untrustworthy, unusable, or irrelevant. Clearly, it has a place and I use it for packages that I am familiar with and trust.
The frame I'm trying to convey is that:
1. Developers are not the only consumers. e.g. If you're in an organization with a security team then adding new PyPI packages without review may not even be an option.
2. The scope of the standard library is debatable, however, I'm trying to focus on functionality that I think should be standard or can reasonably argue such, and in this case, I'm talking about basic functional language features.
3. There is a difference between being included in the standard library and not. Trust, visibility, availability, and keeping people from `re-inventing the wheel`.
4. The provided example is hardly an isolated case, but a fish in the sea of security threats.
5. Reducing external dependencies is generally beneficial.