I'm not sure that putting /usr/local/ before base is good practice. With this patch, a malicious /usr/local/bin/mount could be called instead of /sbin/mount. Would we be better off putting /usr/local/... at the end instead?

My 1st version before upload here was:
/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin
But changed to current after read patch: https://bugs.freebsd.org/bugzilla/attachment.cgi?id=237357&action=diff

I always start with what FreeBSD itself uses (from /etc/login.conf, and I skip ~/bin of course):

$ awk '/path/ {print;exit;}' /etc/login.conf
        :path=/sbin /bin /usr/sbin /usr/bin /usr/local/sbin /usr/local/bin ~/bin:\

At the end of the day, you're the committer. Don't be afraid to modify patches from submitters; they're counting on you for that. Most submitters see changes in the final patch as a learning opportunity.

%%LOCALBASE%% should be replaced with ${LOCALBASE}, obviously.

Here %%PREFIX should be used, I believe.

%%PREFIX%%