On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable.
This is because the file systems may have other concepts of permissions, or none at all. And it is to faciliate sharing between multiple computers. That makes sense.
Usually, you can even adjust this behavior in the mount options. But with the default options, the drives are often auto-mounted with the behavior described above.
Could you consider this a security risk? Especially if it comes to non-technical users, who will only ever use the default mount options (e.g. your grandma whom you switched to Ubuntu).
You could probably say it very much depends on the contents of the drive. But why introduce the risk?
noexec
flag was created long before GUI security was ever considered. While it may have some limited security benefits (e.g. breaking some automated bots that try to download and execute a file in/tmp
), it is not designed for security. See also this answer as linked above. – forest Sep 28 '18 at 10:53