I believe ssh-agent has always written it's socket files to /tmp, in directories readable only by the user. If you disagree with this, criticize the program, not the user.