> I still don't understand if the issue involves Py_SetPath() or not.

It seems to me that this issue is concerned with the default behavior that looks for the "lib/os.py" landmark via search_for_prefix() in PC/getpathp.c. Starting at the image path, it searches for the landmark up to the root directory. Any authenticated user can create a "C:/Lib" directory.

That said, I don't think the normal Python distribution is intended to be a base installation for embedding applications, as opposed to using a private copy of the embedded distribution. So in practice there may be no issue here.