It's interesting at least to consider just how much performance is degraded by these hardware bugs for certain workloads. While Octane is 1.40x, the average is 1.12x. And this is the i9 9900k, which has partial hardware mitigations, so speedup is better for older chips.

But mitigations=on doesn't even give full protection from ZombieLoad attacks.. if you want full coverage you need to disable hyper-threading, which kills performance. This caused a big debate among linux devs, but keep-HT won out.

So, disabling mitigations is not a good idea for work or critical workloads. But the chance someone compromises the average computer with one of these hardware bugs is probably the same probability that two equal UUIDs are ever generated.

PC overclockers move mountains trying to eek out half-percentage perf gains. Why not flip a flag for 12%?

I thought this was always known. Common sense even.

IIRC OpenBSD disabled SMT by default, which took away from performance, but overall secured the OS from several CPU-related vulnerabilities.

Not really. All of these bugs only matter in a single scenario: You run untrusted code.

If you don't do this simple action you are not vulnerable.