Is there an update safe way to disable smarty security in templates for CiviMail?
It was hard to finish reading all of your post due to the sirens that go off in my head whenever someone talks about disabling security settings.

Nevertheless, is there really something here that you can't do with a token or a hook? Please could you describe your use case a bit more?

In general, the update safe way is to overwrite core files in a custom templates extension - put it in sites/default/files/civicrm, next to extensions. (That path assumes Drupal, it'll be different in Joomla. You will need to update your resources folder in the Administer menu.

Once you've done that make sure to replicate the folder path in the templates folder. You will likely need to update this file on each CiviCRM update as part of the update procedure (if it changes in core that is).

Good luck!