Given this attack can be run within large userspace programs that are run directly from the network (js via browsers, or within VM boundaries), I don't think th

Given this attack can be run within large userspace programs that are run directly from the network (js via browsers, or within VM boundaries), I don't think that "reasonable" would be the right word. The constraints are pretty small in these scenarios. Once a POC is released it becomes widespread pretty quickly. There's no special size/constraint that effectively stops this attack being run on a large scale.