Alternatively, one could fix distutils.util.byte_compile() to execute the script in safe, empty temp directory.  Running scripts in /tmp remains, as it has always been, a bad idea.

Trying to determine if an import is "safe" can be arbitrarily complicated (e.g. what if the group-write bit is set, but you're the only member of that group, or there are special allow or deny ACLs for other users that aren't detected here).  What notion of safeness belongs in the spec?