Ward against random code execution during package installs

Does cabal currently have any way to only allow a whitelist to use the more powerful compile-time features, like a custom Setup.hs or TemplateHaskell?

Or is this a futile approach to adding more security to cabal users?

Motivation is that there exist several packages on hackage that are one typo away from from existing, well known packages. It does not feel safe that if I ever place a typo when modifying some of my "build-depends", some random package might end up executing random code. One may say one should containerize everything and vet every dependency and use a custom mirror etc. but I'd bet a majority of cabal users are not sufficiently paranoid about this.

(Of course this a client-side approach where we might prefer a server-sided one. If such exist or are in the works, please link them. But I don't think we generally want to block the entire "typo-environment" of existing package names, so a client-sided feature seems to have its merits.)