We used to have a policy that libbfd not terminate an app on error conditions but I see rather a lot of calls to xstrdup and xmalloc.

Did the policy change?  My opinion FWIW is that it's fine for libbfd to terminate on OOM for functions only called from ld, but rude to terminate on anything else, particularly on opncls.c functions.  For example, you might be upset if your gdb session terminated due to attempting to load new symbols.

$ find bfd -name \*.[ch] | xargs egrep 'x(strdup|malloc)'
bfd/elf32-arm.c:  sympp = (asymbol **) xmalloc (symsize);
bfd/elf32-arm.c:      xmalloc (sizeof (arm_unwind_table_edit));
bfd/elf32-tic6x.c:      xmalloc (sizeof (tic6x_unwind_table_edit));
bfd/vms-lib.c:  res->filename = xstrdup (name);
bfd/arc-got.h:  entry = (struct got_entry *) xmalloc (sizeof (struct got_entry));
bfd/elf32-m68hc1x.c:	      buf = xmalloc (strlen (msg) + strlen (name) + 10);
bfd/elf32-m68hc1x.c:		  buf = xmalloc (strlen (msg) + 128);
bfd/elf32-m68hc1x.c:	      buf = xmalloc (strlen (msg) + 128);
bfd/elf32-m68hc1x.c:	      buf = xmalloc (strlen (msg) + 128);
bfd/elf32-m68hc1x.c:		  buf = xmalloc (strlen (msg) + 128);
bfd/archive.c:      n_bfd->filename = xstrdup (filename);
bfd/pef.c:	  unsigned char *buf = xmalloc (symbol->udata.i);
bfd/som.c:  char *tmp_space = xmalloc (tmp_space_size);
bfd/som.c:  char *tmp_space = xmalloc (tmp_space_size);
bfd/elflink.c:  sympp = (asymbol **) xmalloc (symsize);
bfd/opncls.c:  nbfd->filename = xstrdup (filename);
bfd/opncls.c:  nbfd->filename = xstrdup (filename);
bfd/opncls.c:  nbfd->filename = xstrdup (filename);
bfd/opncls.c:  nbfd->filename = xstrdup (filename);
bfd/opncls.c:  nbfd->filename = xstrdup (filename);
bfd/peXXigen.c:  buffer = xmalloc (size);
bfd/elfcode.h:  nbfd->filename = xstrdup ("<in-memory>");
bfd/pei-x86_64.c:  xdata_arr = (bfd_vma *) xmalloc (sizeof (bfd_vma) * ((stop / onaline) + 1));
bfd/pei-x86_64.c:      char *xdata_name = xmalloc (len + 1);
bfd/mach-o.c:      abfd->filename = xstrdup (ap->printable_name);
bfd/mach-o.c:      char *name = xmalloc (namelen);
bfd/plugin.c:  plugin_list_iter = (struct plugin_list_entry *) xmalloc (sizeof *plugin_list_iter);
bfd/syms.c:|         symbol_table = xmalloc (storage_needed);
bfd/elf32-nds32.c:  char *tmp = xmalloc (size);
bfd/elfxx-riscv.c:      char *subset = xstrdup (p);
bfd/elfxx-riscv.c:  riscv_subset_t *s = xmalloc (sizeof *s);
bfd/elfxx-riscv.c:  s->name = xstrdup (subset);
bfd/elfxx-riscv.c:  char *attr_str = xmalloc (arch_str_len);
bfd/elfxx-riscv.c:  char *buf = xmalloc (arch_str_len);
bfd/elf64-ppc.c:	     calls xmalloc, which might cause the program to crash