Why does there need to be empirical evidence of widespread cases of abuse before we address a measure that seems ripe for abuse? Was there widespread security breaches based on Spectre before operating system developers implemented mitigations?