This is for making “pip install” safer, so that dependencies of your packages cannot change under your feet.

However, keep in mind that third-party PyPi packages are not vetted or reviewed for security before they become available. So, they are subject to the same risks for compromise as Arch Linux AUR packages.

A safer alternatve would be to use GNU Guix, which has vetted packages, builds everything transparently from source, and has great support for cross-language projects.