The working directory of oracle processes is ORACLE_HOME/dbs ('database' on Windows) and this is where we find spfile, passwordfile and several other files.
It's not a good idea to save keep those files here. Better to separate binaries (read only, not to backup often, size do not increase) and configuration/variable files that have nothing to do there. There are several means to do it: symbolic links, ifile, parameter for specific files, etc
However, it would be nice to have a simple environment variable for that, such as ORACLE_DBS for example. Somethin similar to TNS_ADMIN we use to put sqlnet configuration files in a different place.