I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on the same being done for capabilities. I assume the same sorts of things are done with capabilities, since otherwise it would have huge security holes, but I haven't been able to find it documented/verified.
As mentioned in this Kernel Mailing List message, whether a process needs extra security is checked in
cap_bprm_secureexec() of the kernel file
security/commoncap.c, which does check for capabilities. This is then exported to the process via the auxiliary vector. This can be accessed/tested via
getauxval(AT_SECURE). I inserted
getauxval(AT_SECURE) into a test program, and it did indeed return 1 when it was running with any capabilities set and usable, the same as it would if running setuid, so capabilities have the same security protections as setuid.