PEP 405 says this:

By default, a virtual environment is entirely isolated from the system-level site-packages directories.

If the pyvenv.cfg file also contains a key include-system-site-packages with a value of true (not case sensitive), the site module will also add the system site directories to sys.path after the virtual environment site directories.

The documentation of the site module says (emphasis added):

If "pyvenv.cfg" […] contains the key "include-system-site-packages" set to anything other than "false" (case-insensitive), the system-level prefixes will still also be searched for site-packages; otherwise they won’t.

However, what actually happens in site.py is different: see https://github.com/python/cpython/blob/3.6/Lib/site.py#L447. The system_site variable is initialized to "true" and doesn't change unless the key include-system-site-packages exists in pyvenv.cfg.

I think system_site should be initialized to "false" so the actual behavior matches the documented behavior.

https://bugs.python.org/issue33456