One note of concern: Why are we stopping at excluding Program Files from being pulled into the package at build? External dependencies (that should be left in their place, and not be sucked into the package build) could lie everywhere. Other common places are Users paths, like for instance plugins to VS Code or other applications use. Or on an external volume, like many license managers do (plug in a dongle with your license files, which create a G:\MyLicense\product.lic for instance).
VIPB already lists a 'Package Source'. That should be the entirety of your source - everything, without exception, outside this Package Source should be considered an external component and be left alone by VIPB. Even if such a file is a mistake, an orphan left out there in the cold by a sloppy developer, it would not be a good help to pull it inside your source during build. It would on the contrary hide the problem from the developer and delay discovery of a package source problem.
Please give the developer control over the package source, instead of running opaque side effects during build.