I'm starting to think it might make sense to deprecate --allow-unsafe and make it the default behavior, but that would be as a separate issue/PR for discussion.

Originally posted by @jcushman in #806 (comment)

Additional context

pypa/pip#6459
https://stackoverflow.com/a/58864335/1529164