With BTI can the attacker not just write a BTI opcode to the start of the jump location? Usually you would jump to a buffer that you control the contents of (i.e. shellcode)
W^X prevents that straightforward attack, by not allowing writable buffers to be executed. The typical way to defeat W^X is ROP chains with gadgets consisting of pieces of code already present in the binary. BTI, in turn, is a defense against that.
I’m not convinced their search for ROP gadgets in libc is useful; often there’s a “magic” address that will do all the work to directly execve /bin/sh if you jump there (in glibc, this is inside of do_system).
I'm not convinced that a conditional branch to the ret followed by breakpoints between it and the ret is enough to remove the usefulness of the gadget as much as they say.
I mean, that's really been their job every time a new mitigation is developed…the introduction of NX led to the use of ROP, which has been joined by JOP techniques as efforts to remove return gadgets gain momentum.
