Bandit B404 security issue with subprocess import?

According to Bandit's documentation, importing the subprocess module is considered a low security issue (B404). Unfortunately, it does not provide alternatives or explanation why. Thus, I have 2 questions:

1. How could just importing this module be an issue in itself?
2. What alternatives should I use instead? Should I import only a specific function from this library or should I just avoid it?