I'm checking some HTTP headers in the server response.
I get a 404 error page. Could in some scenario an attacker leverage a missing
X-Frame-Options header in a 404 page?
There is nothing inherent in a 404 response which protects against attacks like clickjacking (i.e. what
X-Frame-Options tries to address). While most response bodies send with 404 are likely not vulnerable to clickjacking in the first place due to the shown content (i.e. just some more or less fancy error message), browsers do not add extra protection by themselves just because the response code was 404.