As discovered with elexis on IRC today (2019-09-02), mods can overwrite config files, including default.cfg.
This seems wrong, because there are plenty of comments saying this should be impossible (see e.g. GameSetup.cpp:L461)
I've looked around a lot... This is a bit nebulous. This code changed quite a bit over the years, but it seems as far as I can tell that it hasn't worked properly for at least years.
However, vfs_attack does something weird: it first populates a directory, then sets its 'real directory' counterpart.
It would seem much more logical to do the opposite. It comes right away from rP6333, and it seems like the ordering was perhaps a mistake?
This seems to do the correct thing anyways and mods aren't broken.