There is a difference between following good security practices (gratuitous isolation, defensive design) and having exploits ready to show the world how valuable it is. Noone was claiming AMD knew of such exploits beforehand.

What are you even arguing here?

If I observe fact X which is "bleeding obvious", then it's not my responsibility to tell the world about X.

Of course this stuff isn't "bleeding obvious", but I'm going to assume that the AMD engineers thought that it was "obvious enough" to not explicitly to tell the world about it.

Besides... do you have any idea what kind of NDAs those engineers are going to have to sign?

Because they knew it was an obvious security risk?

Perhaps whoever thought about it assumed it was obvious enough that others would have realized it as well. It may simply have never occurred to them that it was worth sharing.