$HOME/.config would somewhat mitigate against this exploit. A user running wget is much more likely to be in their home directory than in .config, and a hidden

$HOME/.config would somewhat mitigate against this exploit. A user running wget is much more likely to be in their home directory than in .config, and a hidden script file is less dangerous if there's nothing around which will execute it. This would still need fixing, but it would be a bit less dangerous.