Relevant excerpt from the changes of the 231 version:
A new service setting MemoryDenyWriteExecute= has been added, taking a boolean value. If turned on, a service may no longer create memory mappings that are writable and executable at the same time. This enhances security for services where this is enabled as it becomesharder to dynamically write and then execute memory in exploitedservice processes. This option has been enabled for all of systemd’s own long-running services.