Two things I've realized in today's Arcalibre work:
โข Calibre makes far more assumptions than I'd realized about how the project is laid out on the filesystem. That makes sense for how early Calibre versions were distributed, but breaks a lot of assumptions that were much later made by PEP 517.
โข Some Calibre features involving fetching updates send an installation-specific UUID to a remote server. It's not the biggest privacy issue, but it's not trivial either.