So I think that a SIGALRM is delivered to the process started via exec().

exec doesn't start a process; it executes a program in the current process. That's why alarm works.

Unless the process changes its signal handler for SIGALRM, that signal will kill the process.

If need be, that can be handled, as seen here.