That doesn't look completely right to me.
You're absolutely right about devtool expecting the tarball in as the 1st item, but this patch here breaks existing recipes like
SRC_URI += "file://some.patch"
inherit pypi
as the patch will now be dropped.
I would suggest to go for SRC_URI_prepend = "${PYPI_SRC_URI} " which fixes the issue *and* doesn't break exisiting setups