That is an interesting discussion.
Summary: the conundrum Google finds themselves in is they want all code run by the user in plain sight: signed by the developer and inspectable by their anti malware tools. It's not difficult to see why they want this.
The stand out counter example is Browsers downloading and running javascript, which is unseen by them, unsigned and worst of all for them utterly impossible to prevent entirely. So in Termux's case it's always going to be near impossible to block interpreted languages like python from running.
The interesting special case is what they called mmap(PROT_EXEC), possibly better called mmap(PROT_EXEC|PROT_WRITE). In other words, the ability to write and execute create code on the fly. JIT's can't work well without it, so without it Javascript is always going to run like a dog. But with it is is always possible to load an ELF binary yourself in user space, bypassing the kernel entirely. Termux could always replace the libc exec() with something that did it that way.
So it looks to me like this is all just re-arranging the deck chairs. Ultimately Google can't use technical measures to prevent any malicious app from running any code they damned well please. Their attempts to accomplish the impossible won't help the malware problem, but does make like difficult for innocent apps like termux.
As others have said this have said, this has nothing to do with Samsung killing Linux on Dex. Unlike Termux, they have to power to turn it all off.