Exactly. To add, nothing prevents from allocating pages from random addresses to get protection similar to ASLR. It can actually be harder to attack dynamical

Exactly. To add, nothing prevents from allocating pages from random addresses to get protection similar to ASLR. It can actually be harder to attack dynamically generated code, because instruction offsets and instructions used will vary from application invocation to another. You could even do intentional variations to ensure no relative instruction offsets are deterministic. So dynamically generated code can have not only have random address (ASLR) but also random relative offsets. Obviously statically compiled code must have those offsets static, known by the attacker. ASLR just means you don't necessarily know where. But once the attacker knows where or has some clever trick so it doesn't matter, it's game over. Unfortunately the creativity of attackers getting around ASLR seems to be endless.