I guess it would make sense to make bashrc, zshrc, whatever immutable to all but root. Never really considered that before. Allowing them to be edited is like allowing you to install or edit binaries anywhere in your $PATH.
- autorun and keyboard shortcuts of your window manager -- one can hook an evil command to Ctrl+C
- ~/.mozilla -- you can add arbitrary javascript to your profile or extensions
- any application which does not expect to have its config externally tampered with and this may result in various errors including RCE
- ~/work/FooProject/Makefile, configuration of your IDE (which contains list of commands that shall be executed to compile)
etc.
An explicit allowlist would be a better option, IMHO perfectly manageable - with a popup window "the app wants to access <file>, allow once | allow permanently | deny".