>Everyone needs to mitigate every vulnerability This is definitely not true, or at least needs a LOT more nuance. All security is an economic equation and invo

>Everyone needs to mitigate every vulnerability This is definitely not true, or at least needs a LOT more nuance. All security is an economic equation and involves tradeoffs of costs and benefits, the value of what's being defended vs relevant threat scenarios. A cloud service provider allowing customers to run arbitrary workloads side by side on the same hardware virtualized? Yeah, they need to pay a lot of attention. A stateless high performance cluster running exclusively vetted, authorized and tuned workloads with no direct net access at all (possibly even air gapped)? Only if it doesn't have any sort of negative performance impact. Etc up and down the spectrum. We're fortunate in software that most vulnerabilities have absolutely zero down side to fixing, they're purely bugs. Or an algorithm no longer considered sufficient that has drop in replacement ones that are superior in every respect. But with some of these hardware issues there can be real tradeoffs in performance/energy usage vs risk. And you can't just say "It will definitely be used in an attack in the future" for everybody, because the conditions to use it are fairly strict. Not everything is "receive a packet from the internet, get pwned". For some systems, any ability for any arbitrary unauthorized/signed code to run is already game over. For other systems, there simply isn't anything valuable to take, the value is the continuous processing done over long periods and the results will be public. If someone notices it's slowing down due to an attacker trying to run their own code it'll just get nuked and paved with an investigation of how they got in.