Immich does

e.g. shell=True allows you to pass the command as a single string

Don’t do this. As the article says its much better to split the string using shlex and avoid the risk of shell injection vulnerabilities.