> [snip rationale about why shutil and not subprocess]
I’m convinced (with one nit: sh in the shutil name does not ring a security alarm for me, as I understand it as “shell-like conveniences in nice, dont-do-nasty-things-with-stings Python” :) but the shell in check_shell_call does warn).

Automatic call of shlex.quote is an argument in favor of the new helpers.