The RPM spec file for mesa-18.0.0-0.1.rc4.fc28 contains this:

export CXXFLAGS="%{?with_opencl:-frtti -fexceptions} %{!?with_opencl:-fno-rtti -fno-exceptions}"
export LDFLAGS="-static-libstdc++"

This throws away all hardening flags for the C++ parts:

/bin/sh ../../libtool  --tag=CXX   --mode=compile g++ -DPACKAGE_NAME=\"Mesa\" -DPACKAGE_TARNAME=\"mesa\" -DPACKAGE_VERSION=\"18.0.0-rc4\" -DPACKAGE_STRING=\"Mesa\ 18.0.0-rc4\" -DPACKAGE_BUGREPORT=\"https://bugs.freedesktop.org/enter_bug.cgi\?product=Mesa\" -DPACKAGE_URL=\"\" -DPACKAGE=\"mesa\" -DVERSION=\"18.0.0-rc4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE___BUILTIN_BSWAP32=1 -DHAVE___BUILTIN_BSWAP64=1 -DHAVE___BUILTIN_CLZ=1 -DHAVE___BUILTIN_CLZLL=1 -DHAVE___BUILTIN_CTZ=1 -DHAVE___BUILTIN_EXPECT=1 -DHAVE___BUILTIN_FFS=1 -DHAVE___BUILTIN_FFSLL=1 -DHAVE___BUILTIN_POPCOUNT=1 -DHAVE___BUILTIN_POPCOUNTLL=1 -DHAVE___BUILTIN_UNREACHABLE=1 -DHAVE_FUNC_ATTRIBUTE_CONST=1 -DHAVE_FUNC_ATTRIBUTE_FLATTEN=1 -DHAVE_FUNC_ATTRIBUTE_FORMAT=1 -DHAVE_FUNC_ATTRIBUTE_MALLOC=1 -DHAVE_FUNC_ATTRIBUTE_PACKED=1 -DHAVE_FUNC_ATTRIBUTE_PURE=1 -DHAVE_FUNC_ATTRIBUTE_RETURNS_NONNULL=1 -DHAVE_FUNC_ATTRIBUTE_UNUSED=1 -DHAVE_FUNC_ATTRIBUTE_VISIBILITY=1 -DHAVE_FUNC_ATTRIBUTE_WARN_UNUSED_RESULT=1 -DHAVE_FUNC_ATTRIBUTE_WEAK=1 -DHAVE_FUNC_ATTRIBUTE_ALIAS=1 -DHAVE_FUNC_ATTRIBUTE_NORETURN=1 -DMAJOR_IN_SYSMACROS=1 -DHAVE_DLADDR=1 -DHAVE_CLOCK_GETTIME=1 -DHAVE_PTHREAD_PRIO_INHERIT=1 -DHAVE_PTHREAD=1 -DHAVE_VALGRIND=1 -I.  -I../../include -I../../src -I../../src/mapi -I../../src/mesa/ -I../../src/compiler/glsl -I../../src/compiler/glsl -I../../src/compiler/glsl/glcpp -I../../src/compiler/nir -I../../src/compiler/nir -I../../src/compiler/spirv -I../../src/gallium/include -I../../src/gallium/auxiliary -I../../src/gtest/include -I/usr/include/valgrind  -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -D_GNU_SOURCE -DUSE_SSE41 -DUSE_GCC_ATOMIC_BUILTINS -DNDEBUG -DTEXTURE_FLOAT_ENABLED -DUSE_X86_64_ASM -DHAVE_SYS_SYSCTL_H -DHAVE_STRTOF -DHAVE_MKOSTEMP -DHAVE_TIMESPEC_GET -DHAVE_MEMFD_CREATE -DHAVE_STRTOD_L -DHAVE_DL_ITERATE_PHDR -DHAVE_POSIX_MEMALIGN -DHAVE_ZLIB -DHAVE_LINUX_FUTEX_H -DMESA_SELINUX -DUSE_LIBGLVND=1 -DHAVE_LIBDRM -DGLX_USE_DRM -DGLX_INDIRECT_RENDERING -DGLX_DIRECT_RENDERING -DGLX_USE_TLS -DHAVE_X11_PLATFORM -DHAVE_DRM_PLATFORM -DHAVE_SURFACELESS_PLATFORM -DHAVE_WAYLAND_PLATFORM -DWL_HIDE_DEPRECATED -DHAVE_DRI3 -DENABLE_SHADER_CACHE -DHAVE_MINCORE -DHAVE_ST_VDPAU -DHAVE_LLVM=0x0600 -DMESA_LLVM_VERSION_PATCH=0  -fvisibility=hidden -Werror=pointer-arith -Werror=vla -frtti -fexceptions  -Wall -fno-math-errno -fno-trapping-math  -c -o nir_types.lo nir_types.cpp

You should preserve %{build_cxxflags} in both cases.  For host compilations (i.e., not things that end up on the GPU), you must not use -fno-exceptions (-fexceptions is mandatory for Fedora). 

LDFLAGS are completely overridden, too.  You should add to %{build_ldflags} if necessary.  (Note that this will turn on BIND_NOW, which may or may not been an issue, depending on how the plug-ins are loaded.)

See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.