I'd be interested in some companion material to evaluate the cost/benefit tradeoff here. My gut says that single user machines it doesn't matter so much, howev

I'd be interested in some companion material to evaluate the cost/benefit tradeoff here. My gut says that single user machines it doesn't matter so much, however these same machines probably run a lot of untrusted JavaScript that may be able to exploit things. A crud rest service receiving requests from the open internet, probably a bad idea to disable mitigations on that machine. On the other hand, a video transcoder or similar picking tasks off a queue and writing back to storage maybe it's fine? Though I'll admit I'm not sure that there wouldn't be ways to cause (sensitive) data to get into the output file, so would default to leaving everything enabled, especially since the input to transcode would be arbitrary