Part of the problem is libgcc:
$ readelf -a /lib/libgcc_s.so.1 | egrep LOAD
LOAD 0x000000 0x00000000 0x00000000 0x12024 0x12024 R E 0x10000
LOAD 0x012024 0x00022024 0x00022024 0x002d0 0x00664 RWE 0x10000
Another part is that -msecure-plt is not the default:
$ echo 'int foo (void) { extern int bar; return bar; }' > conftest.c
$ gcc -S conftest.c -fpic
$ if grep '_GLOBAL_OFFSET_TABLE_-.*@ha' conftest.s > /dev/null 2>&1;
then echo Secure ; fi
$