Manifest items can identify resources with absolute URLs. So an EPUB can theoretically use local file system resource with file URLs.

Using file URLs in the manifest is not a good practice, but has never been strictly forbidden (as far as I know). I think it's probably often used by mistake rather than intentionally. But there might be legit use cases, like an internal documentation system (as @mattgarrish pointed out in #1374).

Would it be reasonable to say that absolute URLs SHOULD have a special scheme that is not file?
In parallel we can also make it explicit what Reading Systems can/should do with absolute URLs as manifest entries.