This is actually less robust, since instead of relying on the setuptools API, you now also rely on the pip API.

If you control requirements.txt, there is nothing "not robust" about parsing it in setup.py.