Just like Spectre/Meltdown, it assumes you have an idea where to extract the secrets from, and more importantly what they secure. A string of random bytes is worth nothing to someone who doesn't know what they're the key to.

...and someone who is running JS is probably also running tons of other JS, adding even more noise to what already exists.