The --help text for execsnoop.c says:
-l, --line=LINE only print commands where arg contains this line
But in practise, it actually compares this against comm like the --name option does. execsnoop.py works as expected here, so I'm guessing this wasn't intentional.