you must either create an instance of the library to use or call a static method directly. Either way, you do something in code to execute anything within the import. Python is the exception to this ...

The Python security team ... was present only in the jeIlyfish library. The python3-dateutil package didn't contain malicious code of its own, but it did import the jeIlyfish library, meaning ...