this is the entire point of defenses like ASLR and stack canaries. the attacker knows they are there, but knowing the form of the defenses doesn't inherently aid the attacker...
Knowing a defense has weaknesses doesn't make it worthless when it takes extra effort for an attacker to exploit that weakness. There is no proven secure consumer OS (I'm including common userland apps in that) so things like ASLR and stack canaries are just extra obstacles to get around.
