A couple of notes for myself and anyone interested.
python3 -m venv /path/to/new/virtual/environment
You use ensurepip module
python -m ensurepip
To run a module, you don't only need to specify
-m, you also want
I as well. Without that, python adds the current directory
sys.path - thus opening the door for a preload attack.