It's not obvious from your discussion, Nick, *why* venv won't use an upgraded system pip if it has been manually upgraded.  There's no need for internet access in that case (which is the argument for using the bundled pip when running ensurepip for the first time).  For that matter, there's no obvious relationship between venv and ensurepip, other than ensurepip making sure there is at least one version of pip for venv to use.

So I agree with the OP that this behavior is quite surprising.  As well as annoying.  Perhaps there is a good reason for it that I'm not seeing?