I have found that the same type of code (checking the given path) occurs in the 'getfile.php' file too. This seems to be called when downloading media. In our case I have modified this file too (diff patch attached), and downloads are now working as expected.
We are experiencing the same issue. I've created github issues number 1295 (can't post URLs in the forum) and put some thoughts about how this could be resolved to allow USER-FILES to be a symlink as worked in previous versions of Xerte whilst still being secure.