In the real world, spies will use the weakest link to infiltrate into certain top secret parts of another country. A newly acquired city is such a symbolic weakest link.
The whole implementation of espionage in civilisation is symbolic and not a 1-to-1 correspondence to reality. You could write a whole new game about espionage and then there would still be elements that would be unrealistic.
The space ship is a project and as such it has no home city. So it doesn't matter in which city the opponents spy is, it can destroy it. It will of course pick the weakest link (if the AI is programmed correctly).
You could argue that the cost to destroy a space ship part and the chance to do so successfully should be dependent on the lowest security level within your civilisation as that will be the point where spies will infiltrate in real life. So in whatever city the spy infiltrates, it should face the lowest counter espionage level within your civilisation. The programmers didn't do that, but just programmed the AI to find this weakest link, the weakest city itself.
You could also argue that the space ship project realistically has increased security levels because that is something you would do in real life. This is also already implemented in the game. Any sabotage on a project has a significantly increased chance to fail compared to sabotaging a tile improvement, sabotaging a normal construction or poisoning the water supply.
Placing a spy in the weakest links in your civilisation, the cities without a security bureau is a good idea. It will significantly increase the chance of capturing the enemy spy that tries to sabotage the project.
Running a counterespionage mission against the likely terrorist nation is also a great way to increase the chance to capture the enemy spy.
Of course, there is always a chance that the enemy spy will circumvent your security measures. Who know, the enemy nation could have employed James Bond.
