- If a vulnerable dependency is in your environment as a transitive of something that's not at risk (e.g. code you don't use, code that doesn't talk to untrusted sites), code that shouldn't use it will pick up that transitive.

- Autodetection of optional stuff is often silent. E.g. libxml vs. pure-python XML parsing doesn't really act any different at load time or most of runtime, besides being faster, so it's non-obvious what's being used when.

- Probing for packages that aren't listed as a concrete dependency by importable name risks loading unintended code due to name conflicts (malicious, or accidental/caused by local files with the same name or weird PYTHONPATH).

- There are plenty of ways to get an ImportError after running a lot of Python code in a dependency before giving up! That code might mutate global state/change behavior, or do insecure things, etc. Malicious actors could take advantage of ImportError being raiseable by user code to conceal naughty behavior at import time.

I really want Python to come up with a saner way to concretely identify (avoiding name conflicts) and probe for optional dependencies at import time. try/except-ImportError ain't it.