And so you now have to make a decision, is this file small or large? This pushes the problem to users and programs. (A very real problem too, we made large changes throughout libguestfs to sort out "small" and "large" files and put them into /tmp or /var/tmp. Entirely unnecessary if /tmp wasn't tmpfs on some systems).

/var/tmp is not allowed if you wish to pass security audits, it MUST be a bind mount to /tmp

What is the rational behind requiring it being a bind mount (or also whatever other options are allowed)?