If they need to be explicitly disabled, which they do, not many are going to do it, not much of an advantage if you ask me.
And I'm assuming my 5$/mo DO droplet isn't on it's own dedicated die....
To be fair though, those chips are a comparatively small part of the datacenter market. Most of them are sitting in IT closets, or per the example above are running HPC workloads on bare metal. Cloud services are the sexy poster child for the segment, but not that large in total.
Stuff like rowhammer is very different vs something like a SQL injection on a website.
They also run games that are just not secure. I know one that was storing user credentials in plain text in the registry (where no special permissions are needed to access it)