This means that if /etc/grid-security/hostcert.pem exists, X509_USER_PROXY is ignored. An environment variable which has been explicitly set by the user should override default locations, no?
Moreover, hostcert has a higher priority than /tmp/x509up_u for gridftp, but not for davs and xrootd. This inconsistency can be pretty confusing for the user, and hard to debug. I had to check the server logs to figure out what was happening, for example, which a normal user will not have access to.
X509_USER_CERT and X509_USER_KEY do have a higher priority than hostcert, though.