My current understanding of the CUPS thing is, the command is only
executed if someone actually prints something on the malicious fake
printer.
So on machines nobody actually does print anything on, things should be
fine.
This is difficult to fix, as all parts work as designed, but together
there is an issue. It's an integration problem, rather than one specific
bug. There may be some of those too, but I'm sure regular bugs are going
to be fixed soon enough.

Just in case, I've removed cups-browsed. It seams my printer /
printserver is still auto detected through avahi-daemon, though, so that
may be another vector, but I don't know.