From a security perspective, to which location should one copy an app inside a docker image?
I don't see a point.

An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there for him.

An internal attacker (who gains access to the container through a misconfigured part of the app or whatever) will also rather easily find them by looking through the process table at /proc and noting the CWDs. 

Attacking the image might be easier with a fixed location, as the attacker only has to add another FS layer, overwriting that directory with his own application. But then, if you did not secure your image store, it does not matter anyways what else you do.

So... I'd say the convenience of a common location is good, and little to no security would be gained; and if, then only security by obscurity, which does not count.