Nah, it's totally normal because you often want to deliberately override or wrap system commands for various good and convenient reasons.

If your concern is that some hacker could put an illicit binary in ~/.local/bin, then your security problems are much deeper than your PATH order.