Uploading files first writes to system temporary folder (insecure) and only then is moved to $settings['file_temp_path']

Problem/Motivation

I found that files that uploaded files are first uploaded to /tmp, once fully uploaded are then moved to the folder set in the $settings['file_temp_path'] variable and then are moved to the final destination (private or public). This is an insecure solution since /tmp is an insecure folder used by the system.

Steps to reproduce

1. Create a node with a "file" type field.
2. Upload a large file you can track.
3. It will be first written to the system temp folder (usually /tmp), then moved to the Drupal $settings['file_temp_path'] location, and then to then to it's final destination.

Proposed resolution

Files should be uploaded directly to the $settings['file_temp_path'] location. This can be set as a secure folder under the "private" folder or some other secure location.