As far as the security questions go, yes, this is one of the benefits of education focused stributions like the Raspbian used on the Raspberry Pi - they can make extra packages available without introducing kids to the idea of downloading and running arbitrary components from the internet before they're adequately equipped to judge the risks of what they're running.

That's the other big reason I think the PyPI approach will be valuable - by offering educators something that's potentially useful to them (a pip GUI), you'd hopefully be able to attract more direct feedback around how to make it ever more suitable to that use case.