My understanding (which could be incorrect) is that the single return location clobbers the branch predictor's leaked data with static and (attack) worthless data without completely clearing the rest of the prediction cache.