> How would you plan to replace the functionality where the venv's bin path is substituted into the script? Purely through introspecting its own path?

It's stored in pyvenv.cfg.

> I presume the security requirements you refer to are purely a Windows constraint - is that right?

Yes (at least for now; not sure what PowerShell Core plans to do about this sort of thing long-term).