libvpx-1.7.0-1.fc28 does not use the complete Fedora build flags for everything.  At least LDFLAGS injection is imperfect:

gcc -I/builddir/build/BUILD/libvpx-1.7.0/third_party/libwebm -I/builddir/build/BUILD/libvpx-1.7.0/vp8 -I/builddir/build/BUILD/libvpx-1.7.0/vp8 -I/builddir/build/BUILD/libvpx-1.7.0/vp9 -I/builddir/build/BUILD/libvpx-1.7.0/vp9 -I/builddir/build/BUILD/libvpx-1.7.0/third_party/libyuv/include -m64 -DNDEBUG -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fPIC -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wdeclaration-after-statement -Wdisabled-optimization -Wfloat-conversion -Wpointer-arith -Wtype-limits -Wcast-qual -Wvla -Wimplicit-function-declaration -Wuninitialized -Wunused -Wextra -Wundef -I. -I"/builddir/build/BUILD/libvpx-1.7.0" -M examples/simple_decoder.c | sed -e 's;^\([a-zA-Z0-9_]*\)\.o;examples/simple_decoder.c.o examples/simple_decoder.c.d;' > examples/simple_decoder.c.d

That leads to missing BIND_NOW/RELRO for various binaries.


More information about RPM macros to set CFLAGS and LDFLAGS is available here:
https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md