What's stopping a Bash script from doing something similar? You could alias ls to a malicious actor for example.
It's the reason './' is not in the default path as well (so you can't place an 'ls' in your home directory and have the admin run your command instead of the real ls).