(re-)mount home [and other?] with noexec (and nosuid [among other useful mount options]) for better security?

[madaidan]

https://seifried.org/lasg/installation/

The “Filesystem layout and structuring” section has a table on which directories to use restrictive mount options on.