The only reason I can see pinning would be bad if folks using pex with no internet connection - which may be a thing. IE: they want pex to use local -f repos for all deps, etc. and those local sources only have old setuptools.