Using different executables instead of the same plugin-container binary would allow us to use different entitlements for web content and plugin processes. Web/file content processes should not have to load any libraries not signed by Apple or Mozilla (unlike Widevine or Flash plugin processes) so this would allow us to use the more strict entitlement that prevents loading of libraries not signed by Apple or the same team ID as the application. See also bug 1529390.

We now have support in our release and codesigning pipeline to use different executables with different entitlements for different child process types. This was used to ship bug 1827747. Content processes and GMP processes now use different executables with different entitlements.