How could a "SECURITY DEFINER" function in PG be insecure with an improper search_path?
If pg_temp is not present in search_path at all, then the temp scheme is always searched first, i.e. as if it were implicitly prepended to search_path.  

The only way to prevent it from being searched first is to give it an explicit presence in search_path.