That's not true at all. Some of the first proof of concept attacks were done in JS. Now the question would be are those attacks still viable given the addition

That's not true at all. Some of the first proof of concept attacks were done in JS. Now the question would be are those attacks still viable given the additional hardening browsers have done independent of the kernel mitigations?