We’re talking about a Python interpreter here. It already executes arbitrary input with the ability to write to files and make network connections.

What type of vulnerability with it just sitting there as an executable do you expect?

Doesn't need to be an RCE to be considered an exploit of the user's intentions. I can't fathom how people are still trying to use an EOL language or why they would even want to. Learn some new syntax, you'll live and the writing has been on the wall for like 20 years.

I don't think a whole lot of people are writing new software in Python 2, but I think a lot of people are still running old software via Python 2. Software they didn't write themselves and wouldn't know how to modify.

And that's not to say those users won't have to find something new eventually (or migrate the software to a contained environment). It just shouldn't happen in an automatically installed update.

Maybe? The timeline here is over a decade. It’s hard to imagine RCE without network facing services.