Yes, but your claim is that applications can still have arbitrary execution vulnerabilities only on operating systems that allow dynamic executable code. I am

Yes, but your claim is that applications can still have arbitrary execution vulnerabilities only on operating systems that allow dynamic executable code. I am refuting that statement by showing that not allowing dynamic executable code is not enough. It is irrelevant to that end that you can mitigate ROP by other means.