Take it from someone who has been working with ports on OpenBSD for 12+ years, FLAVORs are not the answer.
Unless you have an idea about how to get rid of W+X mappings in WebKit and py-cryptography, just mount /home with wxallowed, or use a different filesystem for home directories for users that need virtualenv. You could use /usr/local/home if you don't want an extra filesystem.
