Telling the server of the new root instead, which needs the relevant permissions as the author points out, would remove the symlink traversal on every access?