There doesn’t seem to be anything that we don’t already do or are working on.
There is a section on /etc/fstab which might be useful for (re-)mount home [and other?] with noexec (and nosuid [among other useful mount options]) for better security? - #15 by Patrick