It is well known in the academic literature that attacks "mitigated" by "there's too much noise, you'll have to try too many times, you can attack it in the lab

It is well known in the academic literature that attacks "mitigated" by "there's too much noise, you'll have to try too many times, you can attack it in the lab but not on a real machine" are not mitigated at all. See for instance https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf . A practical case where you have an extended amount of time to attack are when you're an ad in a background tab of a website with interesting credentials.