A spicy take, but there's some truth to it. This class of vulnerability is way more important for PAAS providers that run workloads from multiple untrusted sour

A spicy take, but there's some truth to it. This class of vulnerability is way more important for PAAS providers that run workloads from multiple untrusted sources on the same hardware. Running with mitigations=off on a single user workstation ain't the end of the world, assuming you actually trust the code you're running (and if you don't trust it... why are you running it to begin with?). Desktop OS design still assumes that programs can access user data on disk anyway, after all. (This isn't an excuse to throw buggy / broken firmware into the world and not support it, which is also something these no-name vendors are happy to do)