@whitequark @mcc okay I think I have a forensic reconstruction of a possible scenario:
If you made a --system-site-packages virtualenv and THEN did a pip install --user, it would silently stick things into ~/.local/lib/python3.$X in a way that would be importable by the system python and that would never warn you in any way.
This might be a bug in something