OK, I thought you meant "all OS".
I think it's harmless, because a user who is able to modify the executed string would be able to run Popen themselves, and execute whatever they want already.
I looked in some forums for people having the same issue, and "use shell=True" seemed to be the answer. I'm not claiming it's the only solution, though, we might find something more satisfying in the future.