I don't see the current behaviour as problematic. If you build python as a debug build, you get the -O0 included, if you do a normal build, you get the -Ox included.  At least this is behaviour found in other '-config' programs too.  So maybe add an option to filter out flags, but which ones?

The other issue is that it's unclear what these options are used for, to build an extension module, or to build an embedded interpreter. Not a difference maybe in cflags, but for ldflags. And this should be harmonized with the pkgconfig file too.