When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware eventually runs the packed binary?
Packed malware has a an unpacking stub that will decrypt the obfuscated code and save it to another region. Then it will change that region to executable permissions and then adjust the instruction pointer or jump to the start of the newly written executable code region.
So in order to execute the malware it's basically the equivalent of a jump in assembly to a new like of code or a go to statement to another line or a function call in a higher level language to another area of code.