This is not just one package I'm filing the bug against, some examples are:
mozilla
gnome-common

probably much more packages are affected by this "bug":
on postinstall, a grep action is done on /etc/ld.so.conf to find out if already listed. In case of mozilla, it grep -v's /etc/ld.so.conf into a new file to get rid of it and add it again with echo. Then copy the /tmp file to /etc/ld.so.conf and chmod it. This could be insecure, because the /tmp file has a known name.

The pre/post_remove does the same thing with grep to get rid of the entry and also creates a file in /tmp, which could be insecure. Sed can do this, without creating new files, while having less lines in the install script:

pre_remove() {
sed -i '/\/opt\/mozilla\/lib\/firefox/d' etc/ld.so.conf
sbin/ldconfig -r .
}

this is what I have in the firefox package to get rid of the firefox library path in /etc/ld.so.conf.