I am confused by your point... the article is trying to hack a system where they can only set environment variables, and they found an environment variable that

I am confused by your point... the article is trying to hack a system where they can only set environment variables, and they found an environment variable that can import arbitrary modules. Are you trying to tell hackers to just not import the module?