Python is better than shell, so intruder will use it first.

Python needs an ld.so and libc (minimally) but not a shell or other external utilities. Shebang scripts are loaded by ld.so, not the shell.

Shebang scripts are supported directly by the kernel via the exec family of system calls, so ld.so shouldn't be involved.

https://github.com/torvalds/linux/blob/master/fs/Kconfig.bin...

  config BINFMT_SCRIPT
 tristate "Kernel support for scripts starting with #!"
 default y
 help
   Say Y here if you want to execute interpreted scripts starting with
   #! followed by the path to an interpreter.

Python with batteries included, doesn't that mean exploit tools included?

No personal attack intended, I am wondering this about my own embedded product which contains Python.

Yeah, I remember reading the code in the kernel that handles shebang a long time ago. ld.so is not involved.