>which creates a new REPL with some very important changes
I don't like shrug! I don't want any shrug!
... Of course, if you can arrange for the target system to decode and execute the embedded code, it's already compromised...
>eval doesn't like statements and everyone already knows to suspect exec code.
If people don't equally well suspect `eval` then education attempts have seriously failed.
Incidentally: one way every Pythonista can help improve OSS is to search on GitHub for insecure-but-intentional - as well as inappropriate-but-legitimate -uses of `eval` to submit PRs. For example, it often gets used to convert hex digits to raw byte values (https://github.com/search?q=%22eval%28%5C%220x%22+lang%3APyt...), rather than simply passing a `base` argument to `int`.
