> This could be problematic, adding a suitably named file outside of $PREFIX breaks the python installation.

Might be worth changing it then. I double/triple checked whether 
searching up for the zip file was the old behaviour, and it sure seemed 
to be (it wasn't on Windows). Will only be a little tweak to change, 
since both codepaths are already there.

My assumption was that any higher-level directories in that tree would 
be at least as restricted as where Python is installed, so anyone who 
could hijack it there could also have modified it closer to the actual file.