Yep, as I mention in this thread (https://twitter.com/moyix/status/1025393125567737857) indistinguishability is the hardest missing piece! You're right that you could try to do some kind of profiling and come up with heuristics, but I would note that real security bugs are most often not on a "hot" path anyway (more frequently executed code is actually less likely to contain security bugs, as we found in a paper from last year: https://www.usenix.org/system/files/conference/atc17/atc17-l...).