If you’re mounting a filesystem provided by the user you’re supposed to use the nosuid option which tells the kernel to ignore setuid bits on the filesystem.