Lack of versioning support makes this absolutely unusable for anything but sandboxing. And since the imports are scattered all over the code, it's hard for security scanning tools to check for vulnerabilities and to update libraries regularly. Pip isn't perfect but at least piprot helps me keep libs up to date.

This tool was clearly designed in a vacuum.