Its a good place to point out privilege escalation scenarios arising from being able to write any of these cafile locations (that may or may not exist, or be writable)... create a malicious bundle and wait for root to run composer. Theres obviously easier ways, but add the version checks ;)