/usr/local/bin is a global resource populated by binaries run by many different users including root. Making it user-writable opens the door to privilege escalation attacks by replacing binaries that are then run by other users.
It would prevent privilege escalation attacks on binaries that I have already installed in /usr/local/bin. Yes, packages installed in /opt/homebrew/bin could be attacked separately, but at least the vulnerable binaries are isolated so it's easier to keep an eye on them and make sure none of them are ever run with privileges.
But you're right: to really fix this problem requires that homebrew change its installation process entirely.
