> is set up pretty poorly.

Arguably true. But IRL, there can be all sorts of reasons for some user(s) to have access to /jails/prison_n/ - including limited supplies of time and skill when the host system was set up, or later modified.

Indeed. Just as a linux admin could do something silly with docker volumes or literally anything on any server platform.