Those canaries are meant to detect something bad happening within an executable. These canaries are instead meant to detect something bad happening "between" ex

Those canaries are meant to detect something bad happening within an executable. These canaries are instead meant to detect something bad happening "between" executables of sorts - i.e. malicious usage of said executables/services. It's like placing unlocked safes all over your (locked) house with stuff that looks valuable to thieves. You know it's worthless so you never touch them. If a thief does however, you will know immediately. The overlap with honeypots here can be a bit fuzzy I guess.