From @jduck via the OpenSSF Slack:

Recently I discovered that taking dependency on third party proprietary (prebuilt) static libraries can lead to a false sense of security. Compiling all your code with these flags can't add them to these linked libraries. It's important to understand what you're linking against too.

@david-a-wheeler suggested this might be worth a brief note in the Compiler Hardening Guide as it may be easily overlooked