At a first glance this seems like a bug in llvm-config, nothing obviously related to “default” cflags.
http://llvm.org/docs/CommandGuide/llvm-config.html says llvm-config is supposed to return flags “needed to link against LLVM”, and AFAIK -fstack-protector-strong doesn’t affect ABI so doesn’t need to be returned by llvm-config in the first place.