ROP does not bypass ASLR or canaries. It does bypass DEP/NX in the sense that it executes code that already exists in executable memory.
(Seriously? :-)
Historically EXEs were either linked without relocations or had relocations stripped. They were always loaded first so ended up where they wanted, no relocation necessary. But /dynamicbase flag to linker opts in to setting a bit in the PE header and retaining relocations, so the EXE can be loaded elsewhere.
TL;DR: Windows supports ASLR on both executables and dynamic libraries.
You are correct that the main TEXT section used to typically not be position independent.