I've always wondered if bash/zsh/etc should have a "strict path" setting.

Meaning everything in the path should resolve to sane stuff, like no relative paths, don't allow PATH=.:$PATH and no literal '~' characters (or even space/etc?) maybe check all are directories and exist.