Afaik it's habit to give system paths precedence so a malicious script can't shadow e.g. sudo and steal your password, escalating a local file write into root
Also, if something can write into your path, it can probably write to your shell config and/or the environment variables.
I've always seen home dir, homebrew, etc prepending to PATH.
It is a theoretically nice ideal that fails immediately when you want project specific overrides.
Most people know better.