A hurdle for the attacker?

Even with the first version, in a technical sense it may have needed to be an absolute path, in a practical sense it did not: if a malicious file exploit.pdf knows it will likely reside at /home/user/Downloads/exploit.pdf and likely be opened by an application with /home/user as the current work directory, it can force an access to /proc/self/cwd/Downloads/exploit.pdf and not need to know the user's name.