Also, the most likely explanation for the scenario above is that the
customer has the filesystem containing
/opt/<product>/libexec/<executable> mounted with nosuid.
The problem has been resolved for the customer, and your suspicion about the mount options was right!
/opt was mounted with nosuid.
Thanks a lot for your help! I think I've learned a lot about SELinux by this debug session.