I wonder if this is related to the "capsicum needs you to rewrite programs" bit. I.e. the capsicum man page explicitly says

> Once set, the flag is inherited by future children processes, and may not be cleared.

And mentions that specific new APIs should be used in order to manage processes through capabilities.