Whats best practices for handling Drupal 8 core file paths for vendor package.json
I think this is a slight misinterpretation of the security risk.

The core/ directory needs to be in your DOCROOT; it has assets that the webserver needs to serve up (JS, CSS, and images).

The vendor/ directory should (mostly) be outside of your DOCROOT; some packages have files that shouldn't really be accessed by the webserver directly and have been the focus of recent SAs.

The exception to this are dependencies that need to be served up or be in the proper place, hence why people use the installer-paths to place modules, themes, and JS libraries in the right place.

While not universal, I would say that drupal-composer/drupal-project is a growing best practice, at least for starting points for websites.  This will place vendor/ outside of DOCROOT, take care of the autoloader and scaffold files, and set up a sane set of installer-paths.  Even if I am not using this directly, I look to its composer.json for inspiration.