Once the data escapes the CPU via a load or store, it's hard to enforce something like a "type" in hardware. ALU instructions operating on what appears to be integers could easily have been operating unknowingly on virtual addresses. Even if you used the "integer add" instruction, there's no way for it to know that it didn't just index into a buffer using a virtual address as a base.

However there are cooperative ISA features -- between compiler and CPU -- these can be used to constrain untrusted attackers. See ARM PAC, e.g.

the point is to put a guard when performing indirection, that checks a type bit in the register. setting this bit is a privileged operation. unprivileged address arithmetic can be performed if addresses also contain a bound.

but the whole point is that you just cant hand any integer to the hardware and ask it to fetch.

See CHERI and Arm Morello https://www.arm.com/blogs/blueprint/morello