Because a system is secure as long as somebody doesn't break it. If tomorrow someone comes with an algorithm that can factor a prime number in polynomial time R

Because a system is secure as long as somebody doesn't break it. If tomorrow someone comes with an algorithm that can factor a prime number in polynomial time RSA will be useless basically, but since then we consider it secure. Beside that, all these vulnerabilities comes from optimizations done by the CPU. The only reliable way to avoid them is not to have the optimizations to start with, and that is what mitigations do. It's the choice of the user to choose if he wants or not the mitigations, I personally have `mitigations=off` on my machines because I think that the security threat is not so big for my workflow.