1. Disable swap/backup files in your editor (or write them to a different location)[1]
2. Git ignore or SVN ignore swap files and backup files
3. Configure your web server to not serve such files.
Some combination of these should keep you safe. :)
[1]: in vim: noswap nobackup nowritebackup or http://vim.wikia.com/wiki/Remove_swap_and_backup_files_from_...
And shared hosts don't generally allow files outside the webroot of a site. When they do, they might already have open_basedir set to only allow inclusion WITHIN the webroot.
Most packages like Wordpress are developed to run on the maximum number of servers. It isn't built to run on the best, or smartest configured ones—but the average, out-of-the-box Apache/PHP install.
Example: PHP 5.5 will be running for the next billion years because when mysql_query is finally put to rest in newer versions all those applications that depend on it will fall over. Thus, a legacy version of PHP will be supported by hosts, bugs, security holes and all.
"You either die a hero, or live long enough to see yourself become the villain..."
PHP crossed the line from hero long ago.
Everything was written below a public root, but the shared host didn't allow this, so the next thing you saw was: domain.com/publicroot/index.php^ when the new developer took over. The funniest thing was that they had internal subdomains which ended up public as well, one with full customer listings.
"Never attribute to malice that which is adequately explained by stupidity." - Hanlon's Razor
^ fake path