GnuPG invokes its components always with their absolute file name. We want to mitigate attacks where malware creates a pinentry wrapper somewhere in an improper set PATH.

What about adding a dedicated note on how to properly configure pinentry?

So this is a defense against an adversary capable of creating a pinentry-wrapper somewhere in $PATH, but not capable of modifying gpg-agent.conf? It sounds to me like this is a defense against a very unusually-constrained attacker, at the expense of regular, common bug reports and user confusion.

I don't understand this tradeoff.

As I said we do this with all GnuPG components. Pinentry is a bit of exception because it is an external package.
I have also had bug reports which later turned out that a wrong pinentry was used; I prefer to know eactly which pinentry is used. Regarding your concrete problem I suggested to add a note with the full name of the pinentry or to change the error message to something better understandable.

What can be done is to use gpgconf --list-dirs bindir as a fallback for pinentry.

What about at least accepting env variables OR tilde expansions? That will make it easier to integrate with dotfiles that intentionally use a home-dir based executable without having to pass the full path, so it could work cross platforms.

i.e. I wouldn't need to swap between /home/myuser/bin/pinentry and /Users/myuser/bin/pinentry if a simple ~/bin/pinentry could work.

I'd also be interested in expanding tilde expressions for dotfiles portability, since I don't use the same username in all my machines