First: I agree with you.

As for the reason: I believe it's for 'performance gain' as those mitigations have performance impact

It's a silly thing to do by default but the vast majority of people do not need them and can't justify the loss of performance on every context switch. The only untrusted code people tend to run on personal computers is in the browser, where you have same address space sandbox escapes which OS mitigations don't typically mitigate.

You're protecting against one process attacking another process, or one process attacking the kernel. That's not your threat model on a personal device. Your threat model is much more likely that whatever process you're running has complete access to all your files, there are a lot of issues unsolved before even considering speculation and sidechannels