True, a privileged process having data-dependent execution time for secure data can lead to a variety of side-channel attacks.

For more complex cases than password validation, it would help if it were easier to write side-channel-resistant algorithms in something other than assembly. Even a C compiler, let alone something higher-level, can introduce side-channel leaks through optimization.