You’re grossly underestimating how difficult it is to pull off these exploits in practice. Even before getting to post compromise activity the adversary has to

You’re grossly underestimating how difficult it is to pull off these exploits in practice. Even before getting to post compromise activity the adversary has to have a JavaScript VM escape, and also escape the browser sandbox. That shit is worth serious cash and nobody is gonna be spamming the internet with their precious zero days. Even then you have to perform privilege escalation and map out the network. By this point you’re already pwned. The adversary isn’t gonna be looking for or even capable of pulling off a low level cpu exploit.