> So it should be, "if they fail and you're in a context where exceptions are allowed, raise an exception" (which will chain back to the one raised from an audit hook".

What exception should be raised if _Py_fopen() fails (returns NULL)? We can't just check errno anymore because _Py_fopen() might have failed because of the audit hook and thus didn't set errno. So it seems to me that addition of audit hooks broke the implicit contract of _Py_fopen()/_Py_wfopen(), and callers were not fixed.