Part of the problem is that existing ISAs have been (and still are) underspecified. At best software was software was written against observed implementation be

Part of the problem is that existing ISAs have been (and still are) underspecified. At best software was software was written against observed implementation behaviour. More commonly software wasn't written against any (formal) specification from simple things like is shifting by a variable number of bits a constant time operation, to nastier things like does the latency of multiplication leak the magnitude or hamming weight all the way to does the the implementation speculate past permission checks and leak observable state changes left behind by speculative memory accesses. Most instruction sets don't specify the presence and absence of side channels. RISC-V is in a better position than most other ISAs to fix this "oversight".