References to packages path in security status checks are assumed to be under civicrm root
As noted by @seamuslee at https://github.com/civicrm/civicrm-core/pull/17822#issuecomment-657889572 there are some more spots that assume packages is under the civi root.
They're likely too old to affect someone upgrading a drupal 8 site, but might apply to other CMS's and should be updated.
PR pending