> My brain wants to think it's "too late" to set `user` to anything by then, because the value was already read out

It doesn’t set `user`, it returns the User passed to the function.

Computing the second return value modifies that value.

Looks weird indeed, but conceptually, both values get computed before they are returned.