Comment 6 for bug 2009967

Somehow it's the $(filter-out ) makefile mechanism that is doing it:

Makefile:
dpkg_buildflags = DEB_BUILD_MAINT_OPTIONS="hardening=-pie $(DPKG_OPTIMIZE)" dpkg-buildflags
DPKG_CFLAGS := $(shell $(dpkg_buildflags) --get CFLAGS)
DEBUG_CFLAGS := $(patsubst -O%,-Og,$(DPKG_CFLAGS))
OPT_CFLAGS := $(filter-out -O%,$(DPKG_CFLAGS)) # default is -O3

all:
    DPKG_CFLAGS="$(DPKG_CFLAGS)" echo
    DEBUG_CFLAGS="$(DEBUG_CFLAGS)" echo
    OPT_CFLAGS="$(OPT_CFLAGS)" echo

$ make
DPKG_CFLAGS="-g -O2 -ffile-prefix-map=/home/ubuntu/x=. -flto=auto -ffat-lto-objects -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security" echo

DEBUG_CFLAGS="-g -Og -ffile-prefix-map=/home/ubuntu/x=. -flto=auto -ffat-lto-objects -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security" echo

OPT_CFLAGS="-g -ffile-prefix-map=/home/ubuntu/x=. -flto=auto -ffat-lto-objects -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security " echo

OPT_CFLAGS got the extra space, whereas the rest didn't.