currently don't see why we'd need to run something from the temporary directories pmg uses - so `nosuid,noexec,nodev` should really not be a problem
While this is a matter of taste - /opt is for third-party applications - and for me PMG is not a third-party application on a installation - so...