Comment 1 for bug 1799185

Confirmed.

Steps to reproduce it, for others who, like me, are not familiar with spamassassin:

Start the daemon as root, with the given options plus debug:
spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D

Get some spam message from your spam folder. The raw message (in gmail, select "show original"). Copy it into a file, say spam.txt.

Run "tail -f /var/log/mail.log" in one terminal

Run spamc on that file as a regular user in another terminal:

spamc < spam.txt

Watch the log file and look for the error:
Oct 23 14:41:45 cosmic-spamassassin spamd[10067]: config: using "/var/lib/spamassassin/vconfig/ubuntu/" for user state dir
Oct 23 14:41:45 cosmic-spamassassin spamd[10067]: config: mkdir /var/lib/spamassassin/vconfig/ubuntu/ failed: Insecure dependency in mkdir while running with -T switch at /usr/share/perl/5.26/File/Path.pm line 1
77, <GEN9> line 2.

Also note that /var/lib/spamassassin/vconfig/ubuntu isn't created.

Edit /usr/sbin/spamd and remove "-T" from the shebang. Repeat the above steps. No error, and the directory will be created this time.