I checked again with grep (which I'd done earlier) and confirmed that there's no code in our standard packages that sets context_id explictly to zero or security_context_root (via the magic object table.) content_keywords sets context_id of a new keyword to its parent but it defaults to NULL for the root rather than security_context_object, which is right.
My mistake was to assume that no one had done this in past versions of packages like ETP ... serves me right, I guess!