I don't think PR 24559 will be sufficient to fix this.

Pickled functions need to share the builtins dict, not just have a copy of it. Adding a "builtins" parameter to types.FunctionType() should be be enough.

So:

function(code, globals, name=None, argdefs=None, closure=None)
would become:
function(code, globals, name=None, argdefs=None, closure=None, builtins=None)

The change to cloudpickle is a bit complex as the pickle code would need to change the arguments to  types.FunctionType() from (code, globals, name, argdefs)
to
(code, globals, name, argdefs, None, __builtins__.__dict__)
but __builtins__.__dict__ cannot be pickled.

So cloudpickle will need to emit pickle bytecode to create the tuple, using the unpickler's __builtins__.__dict__.