re: security implications
On Debian the dynamic linker goes into secure-execution mode not only for classic set-uid binaries but also whenever the file has POSIX capabilities (for example sudo setcap cap_dac_read_search=+ep /bin/find which grants find some extra superpowers, effectively restricts LD_PRELOAD on it)