Sorry, I hit Enter by accident. libffado-2.4.0-4.fc28 does not build all binaries with full hardening flags. /usr/bin/ffado-bridgeco-downloader, /usr/bin/ffado-dbus-server, /usr/bin/ffado-dice-firmware, /usr/bin/ffado-fireworks-downloader, /usr/bin/ffado-set-nickname do not use the standard linker flags (LDFLAGS) from redhat-rpm-config package. I tried to fix this in libffado-2.4.0-4.fc28, but apparently, makefile changes are needed, too. More information about RPM macros to set CFLAGS and LDFLAGS is available here: https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md
You forgot to put the "export LDFLAGS=..." into the %install section. Whenever these flags differ between %build and %install, scons triggers a rebuild of the affected files in %install. So these files are built twice. Once in %build and once in %install. And the second builds, which have empty LDFLAGS, are being installed.
fixed in rawhide