An attacker would have to set such a flag before the binary was loaded, meaning they've already achieved code execution (and syscalls).

This feature is yet another layer of defense against remote exploitation of a currently running program (for example, a web browser). It complements things such as ASLR, stack canaries, the NX bit, ...