After some discussions it seems the original news was not clear and that it is valid to manually pass the branch protection flags iff GCC target libs are built with them too. The main difference between manually passing the flags and using the configure option is that the latter also makes branch protection the default in GCC which may not be desirable in some cases.
42c9e9af22 aarch64: update NEWS about branch protection
NEWS | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)