I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on the same being done for capabilities. I assume the same sorts of things are done with capabilities, since otherwise it would have huge security holes, but I haven't been able to find it documented/verified.
Security of capabilities vs setuid (LD_PRELOAD, etc)
linux;security;setuid;capabilities;setcap
As mentioned in this Kernel Mailing List message, whether a process needs extra security is checked in cap_bprm_secureexec() of the kernel file security/commoncap.c, which does check for capabilities.  This is then exported to the process via the auxiliary vector.  This can be accessed/tested via getauxval(AT_SECURE).  I inserted getauxval(AT_SECURE) into a test program, and it did indeed return 1 when it was running with any capabilities set and usable, the same as it would if running setuid, so capabilities have the same security protections as setuid.