It doesn't matter if attackers can intentionally use older browsers, they can also use other tools like curl or even an intentionally malicious browser applicat

It doesn't matter if attackers can intentionally use older browsers, they can also use other tools like curl or even an intentionally malicious browser application that doesn't have these features either. It matters if users use the secure browsers, and with Chrome, Firefox, and (hopefully) Safari implementing it the vast majority of them will within a few release cycles.