We have encountered a similar situation in our projects. All other compilation flags, except for fortify, produce the expected checksec output.

If anyone is interested in verifying whether it works as expected, we have a Minimal, Verifiable, Complete Example (MVCE) available here: Stoppable_MVE

It makes use of memcpy and memmove, which should be fortifiable functions.

The compiler settings file can be found at: compiler_settings.cmake