Our security flags cause package check warnings, which are simply annoying at best, or users may misunderstand at worst. We should document those.
There's also a way to get rid of them during package checks without altering the installation of packages:
Makeconf
~/.R/check.Makevars
R_MAKEVARS_USER=~/.R/check.Makevars
~/.R/check.Renviron
From R Internals:
Environment variable _R_CHECK_COMPILATION_FLAGS_KNOWN_ can be set to a space-separated set of flags which come from the R build used for testing (flags such as -Wall and -Wextra are already known).
_R_CHECK_COMPILATION_FLAGS_KNOWN_
-Wall
-Wextra