See https://github.com/facebook/phabricator/pull/563.
I think this secondary construction of a $user is very old, and predates subsequent changes which cause a proper user to construct earlier, so using the user on the $request should (I think) always work. I couldn't immediately find any cases where it does not.