All of that is built on IronPython2 still, so… yeah. 
If you’re placing a Python node on canvas you can choose the engine.
If you are placing zero touch nodes on canvas Python isn’t a security concern. These are the nodes which cannot be edited.
If you are using dyf based nodes when you download the package you should see IronPython2 listed as a dependency in the package manager.
If you already have a library of packages in use and want to flag IronPython2 packages you can write some Python (using the CPython engine) to flag any nodes/packages which use IronPython2. This post of mine from nearly a month back has a POC to do such that: Reload Family from Folder - #20 by jacob.small