Postgres security for functions with "security definer"
pg_temp is always in the search path.  If you don't add it to search_path parameter explicitly, it will behave as if it were there at the beginning of the setting.  That means the user could create tables which masked the ones the function was supposed to operate on.