rustup configure an insecure PATH by default.

Problem

Configuring the cargo path in the first section of the $PATH creates an extra insecurity on the system, as the comment says it's overriding the system binaries.
It would be more secure to put the "$HOME/.cargo/bin" at last section of the $PATH.

.cargo$ cat env
#!/bin/sh
# rustup shell setup
# affix colons on either side of $PATH to simplify matching
case ":${PATH}:" in
    *:"$HOME/.cargo/bin":*)
        ;;
    *)
        # Prepending path in case a system-installed rustc needs to be overridden
        export PATH="$HOME/.cargo/bin:$PATH"
        ;;
esac

This gives to a local attacker the possibility of overriding sudo or other binaries to get user password or root access.
For sure having access to the account there are other attack vectors, but this open an extra attack vector.

Steps

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Possible Solution(s)

export PATH="$PATH:$HOME/.cargo/bin"

Notes

No response

Rustup version

rustup 1.24.3 (ce5817a94 2021-05-31)                                                                      
info: This is the version for the rustup toolchain manager, not the rustc compiler.                       
info: The currently active `rustc` version is `rustc 1.56.1 (59eed8a2a 2021-11-01)`

Installed toolchains

Default host: x86_64-unknown-linux-gnu                                                                    
rustup home:  /home/sha0/.rustup                                                                          
                                                                                                          
stable-x86_64-unknown-linux-gnu (default)                                                                 
rustc 1.56.1 (59eed8a2a 2021-11-01)

Start with the generated .cargo/env shell setup shown in the issue and trace how the install command creates it. Change the PATH ordering so $HOME/.cargo/bin is appended rather than prepended, then verify a fresh rustup installation produces the safer PATH behavior.