The issue is that an exploit could write a file in ~/bin/ and trick you in to executing it. But, if something malicious is writing files in your home directory, you've already lost.

If someone can write to your home directory they can also update your bashrc file and add whatever they want to PATH

It's a default behaviour of at least bash. It's as secure as your home directory is.