Because of javascript's wide surface area, it's nigh-impossible for browser manufactures to be sure that they've disabled indirect access to timing data.

The original proof of concept didn't even use a "precise timing API", it features `while(true){ i++; }` to increment a counter, and pulled timing information out of that side-channel.

It is trivial for the browser vendors to disable access to a specific API, but we're in for a game of whack-a-mole.

Dismiss the exploitability of javascript at your own peril - sure, WebWorkers and SharedArrayBuffer are this week's blocked timing attack, but smart money says there are other ways to get timing information that are unpatched.