It could be an implementation written in the buggy Python and another written in a different language.

For example you might use a ready-made WAF written in a non-Python language in front of a Python app.

With web applications it's not particularly unusual, because the whole system stack can be quite heterogeneous. If one part of the system is doing authentication and the other part is actually doing the action then it can be a real problem when they interpret the input differently. Differences between proxy and web server interpretations of HTTP headers have been a source of multiple vulnerabilities, for example.

Consider the case where your system has components in python and another language without the bug, both of which process that input.

It isn't until it is, until during a crunch someone adds a package with that condition and eventually that gets exploited or halts the system. It's never a nitpick to shed your system from undesired state because of how complex systems behave.