Headline is slightly misleading here. The 40% figure refers to "full mitigation" which has to be activated via a terminal command. The default is for the update

Headline is slightly misleading here. The 40% figure refers to "full mitigation" which has to be activated via a terminal command. The default is for the update to apply a partial mitigation that protects Safari users from exploitation via JavaScript without degrading performance.