Software can choose to invalidate all cache, fence access, and the like today. It may not be a single instruction but it's not far off. Usually something like "just don't JIT JS to native code" is "secure enough" most don't want to go down that route. The mitigations are the way to keep the most overall performance, so they are the most popular.