I think it's interesting to consider what's preferable for a manufacturer, releasing a high performance CPU that gets you a lot of sales initially and then having to deal with the fallout from a vulnerability getting exposed somewhere down the line, or addressing it prior to release and having a less competitive product. Take Alder Lake for example, Intel got a lot of kudos for it's performance relative to prior generations and indeed AMD. Imagine they had some vulnerability that needed a 10% performance hit to mitigate. Does intel want that addressed pre launch or would they rather ship the product, grab market share and then worry about the vulnerability later?