Currently we don't enable CFG (which is runtime protection against code injection into tables), because it likely has a performance impact and the kind of attack is outside our scope.

However, we should make it easier to build CPython with CFG enabled, so that third-parties who do want to include it in their scope can do so.

FWIW, I don't actually know what the performance impact is. I'm not set up for running the perf benchmarks, and I don't know if anyone else is (on Windows), but if someone would like to then it'll be easier once the environment option to enable it is in there.

New changeset 5af56c6f2a0d11df37fed7ecaaf321cf6926ba13 by Steve Dower in branch 'main':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
https://github.com/python/cpython/commit/5af56c6f2a0d11df37fed7ecaaf321cf6926ba13

New changeset 9580d3894ad158ae909e7573a02dcd087de0b673 by Miss Islington (bot) in branch '3.9':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
https://github.com/python/cpython/commit/9580d3894ad158ae909e7573a02dcd087de0b673

New changeset 42612db10792dd069149063f67a3b1db700bc7ee by Miss Islington (bot) in branch '3.10':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
https://github.com/python/cpython/commit/42612db10792dd069149063f67a3b1db700bc7ee

I'd like to leave my pyperformance (x64) results here.
cpython: ae5259171b8ef62165e061b9dea7ad645a5131a2 (2021-8-23)

1) release + CFG      : 1.00x

2) release + CFG,/Ob3 : 1.05x faster | 41 faster
                                     |  9 slower
                                     |  8 not significant

3) release (default)  : 1.07x faster | 52 faster
                                     |  4 slower (regex_v8,
                                     |            regex_effbot,
                                     |            nbody,
                                     |            hexiom)
                                     |  2 not significant

4) release + /Ob3     : 1.11x faster | 56 faster
                                     |  1 slower (regex_v8)
                                     |  1 not significant (regex_dna)

5) PGO + CFG          : 1.15x faster | 53 faster
                                     |  2 slower (regex_dna,
                                     |            pidigits)
                                     |  3 not significant

6) PGO + CFG,/Ob3     : 1.15x faster | 54 faster
                                     |  1 slower (regex_dna)
                                     |  3 not significant

7) PGO (default)      : 1.21x faster | 56 faster
                                     |  1 slower (regex_dna)
                                     |  1 not significant (regex_effbot)

8) PGO + /Ob3         : 1.21x faster | 57 faster
                                     |  1 slower (regex_dna)
                                     |  0 not significant

That looks to me like no impact at all, which is great to see!