
The -s flag assures that nothing can be installed to user site-packages but doesn't keep ensurepip from looking there for Pip. If Pip is installed in the user site-packages directory, pip won't be installed for the newly built python -- and its shim won't be created. -I makes the build install Pip in any case. The user site-packages installation will override it -- but we'll have the shim at least.