Subdirs of $HOME are used as defaults. So using $HOME alone is not enough.
Also, prior to xdg dirs, applications were (many still are) storing their data under $HOME/.myapplication/.
My comment is sarcastic, obviously. The argument Kairos gave is similar to this. You can still introduce vulnerabilities. The issue is normally that you introduce them accidentally. Rust gives you safety, but does not put your code into a sandbox. It looked to me like they weren't aware of this difference.
I'm using arch, btw.