What's bad about pinning the transitive dependencies? I feel otherwise this could lead to really hard to debug errors down the road if second-order dependency versions diverge between developers.

And I fully agree on the tools. I personally would always use something like pip-tools or poetry, but it's not always an option to use them, unfortunately.