But line 3557, which in Emacs 24.4 is

. $srcdir/nt/mingw-cfg.site

comes _after_ the check for an unsafe srcdir, so how is this sequence possible?

Well, that's what happened to me.

(I see that most of your patch is entirely stylistic, changing $var for
${var}.)

My patch adds double quotes around `${srcdir}' in at least 6 places.

I think we should wait till that day arrives in autotools and make,
before worrying about it in Emacs.

Orders are orders.