I'd say bashrc and profile and friends are one of the few examples in which using hardcoded paths is OK. Same with SSH, GPG, and PAM.
But when people are talking about compliance, and hardcoding very few people are talking about those applications - there are hundreds of other applications do the wrong thing, and some scripts hardcode things as a result.
No, but don't keep doing it that way for new software, or even new files. You existing config file is in ~ because it's 30 years old. Fine.
If you get to the point where you need another file for something, put it in a directory under .config so whenever you need to add even more, you don't keep cluttering my home.
As a defence of hardcoded paths might go, I could've done better myself. What else from your OS 30 years ago might you keep just because it's 30+ years old?
I keep it because it's worked for 30 years without issues and it's still working. Must you always replace something, just because a newer thing is "out there"? On the other hand, this is hackernews, and rewriting everything, from a text editor to a file browser, into a <language of the week> (ruby, go, rust,...) is a thing.
Try moving all of those directories and files somewhere else that you would prefer and then see which programs break, which apps and libraries won't install, and then wonder why hardcoding is something the devs for these projects cling to.
To be pedantic, if we're going to cite Unix history, then technically there is no such thing as a "hidden" file. As I understand, the original implementation of tools like ls would not show the current directory "." in the listing. The quickest way of doing this in C was checking whether dentry.name[0] == '.'
This also had the side effect of hiding entries that had names beginning with ".", and over time an implementation bug/quirk became accepted behaviour, and was post-hoc rationalised as "hidden" files.
But when people are talking about compliance, and hardcoding very few people are talking about those applications - there are hundreds of other applications do the wrong thing, and some scripts hardcode things as a result.