OpenBSD has great security mitigations too, ex.: W^X: https://en.wikipedia.org/wiki/W%5EX
But, the /usr/local FS needs to have "wxallowed" mount option because of Google Chrome, because it won't start without it.
"wxallowed" disables the W^X on the given FS.
The Question: does Google Chrome has this seriously bad quality code, that it needs wxallowed, or is this something more complex?
Ex. good example: Firefox simply works without the wxallowed option, so it uses the W^X mitigation, which is great.
But another bad example: LibreOffice doesn't starts without wxallowed too..