False positive for `--check-safety` (variable is actually used afterwards)

[flying-sheep]

Out of curiosity I ran --check-safety on one of our pickles: https://github.com/scverse/scanpy/blob/1.11.x/tests/_data/objs_t_test.pkl, with fickling saying:

Variable _var16 is assigned value scalar(_var15, b'0\x00\x00\x00') but unused afterward; this is suspicious and indicative of a malicious pickle file

but if I trace execution, I see:

[…]
_var16 = scalar(_var15, b'0\x00\x00\x00')
[…]
_var24.__setstate__((3, '|', None, (_var16, _var19), {_var16: (_var21, 0), _var19: (_var23, 200)}, 400, 1, 24))
[…]

so seems like --check-safety doesn’t work correctly.