What are the differences between WPINC and ABSPATH?
You can check yourself. Just look at
wp-load.php on the WordPress mirror on GitHub.
Even a quick glance will show the currently selected answer is no longer correct as to how
ABSPATH is defined. And if you compare different tags on GitHub you will see the
ABSPATH definition actually changes over time.
Which one is the 'right' way to do it?
Given these are used for security, I'd go for
ABSPATH. Rationale being that
ABSPATH is not only defined first in the WP bootstrapper,
WPINC is defined under a conditional in the same file and, as a result, is more likely to experience a future regression.
Also, while not explicitly asked, you provided examples using both
exit. According to
devdocs.io, which draws on official API documentation,
die is equivalent to
exit, so you could choose either of the two and it won't make a difference.
exit accept arguments, so you could consider using them to output some useful information, such as an encrypted version tag or contact information, upon abend, or pass an exit code such as
-1 for further processing.
Also worth noting is that
wp_die is a thing too. Not to be confused with the PHP built-ins, but compliments them for use in outputting HTML in addition to plain text and is used liberally throughout the WordPress core currently. Learn more about
wp_die on WordPress.org.