@ollehar : to really protect a directory files from web : the only solution ar to put out of directory of host (see php session file for example).

Then , the idea config-default:
$config['tempdirsecure'] = $config['tempdir'];

After just use tempdir when set runtime path or upload path (or some other).

By default : leave like curretly, but with manual: we can easily explain how to secure more LS.
ANd with some config.php instruction more.

Maybe we just need
$config['runtimepath'] = $config[''tempdir''].'/runtime/';

See https://github.com/LimeSurvey/LimeSurvey/blob/master/application/core/LSYii_Application.php#L61

And we can do same for asset (but very less necessary)

Fix committed to develop branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=21888

https://manual.limesurvey.org/index.php?title=Optional_settings&type=revision&diff=69431&oldid=69362

In fact : Yii already offer to set runtimePath : then best solution are :
set to $settings['tempdir'].'/runtime' only if it's not already set.

I do it for master and merge in develop after (because i know what problem happen : i update code at same place ).

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=22153

Fix committed to develop branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=22225

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=22339