AFAICT, if you install NetBSD from scratch, non-root users can no
longer run mail correctly, because mail will always fail to lock
the mailbox, because /var/mail is not writeable by it.

While the security problem here is obvious, is there any reason
mail isn't being changed to adapt?

-s