Going through the commits for Issue 22896, I noticed compile(), eval() and exec() also suffer from a similar flaw. They check strlen(buffer) but the buffer may not be null-terminated:

>>> eval(memoryview(b"1234")[1:3])
TypeError: source code string cannot contain null bytes