We have recently added -z,relro and -z,now for coreclr stuff, we should add it to the libraries and installer native binaries too.
Also, installer executable binaries are built without the PIE options, which needs to be fixed too.