Why would we remove the pickle serializer? It's only a problem when (de)serializing against user-controllable storage. Pickling, as far as I understand, is more efficient and just as safe when serializing to the DB, for example. It's true that when we need to choose defaults, we should lean towards "more robustly safe" rather than "economical", but let's not kill economical. It has its uses.