There's a bunch of places that can still get tripped up:

- scripts with `#!/usr/bin/python` instead of `#!/usr/bin/env python`

- shell scripts which call /usr/bin/python directly instead of the one in your path

- shell scripts which intentionally set a prefix in $PATH to some vendor directory with a custom python, but the vendoring is incomplete and leaky and it implicitly loads packages from your system python anyway

plus a hojillion other things I'm not thinking of...

But scripts calling /usr/bin/python want to use the "system" / "bundled" Python - why would you want those to run with your version of Python???

Because in 120% of situations, that "want" is actually "I had no clue how *nix works and just pasted in the result of `which python` in my system".

Do you think the same is true of #!/bin/bash? Why not?

GUI apps also have their own special $PATH set via launchctl.