There are almost certainly unmitigated Spectre-style bugs hiding in modern hardware. People who don’t block JavaScript by default are impossible to protect anyway.