RSA and ECC have similarly-shaped common implementation strategies; just the underlying field arithmetic is different. You have a secret input (an exponent in RSA, or scalar in ECC) and work through it bit by bit, doing different operations if a bit is set vs not set (RSA: square and perhaps multiply, ECC: double and perhaps add). If the sequence of operations is visible to attacker (via power, time, cache, branch predictor, etc.) then your secret key does, too.

So, ECC implementations are not generally in a better state than RSA.

This is why curve25519 and its ilk are so much better; they can be efficiently implemented using the Montgomery ladder which is really very easy and cheap to make free of side-channels.

libgcrypt was written before timing side channels were an issue. modern crypto libraries (and OpenSSL) are at least supposed to be constant time and not to be affected.

I don't really know much about the topic, but... How about using specialized, external hardware for each instance of crypto calculations?