You don't need to have a practical attack for something to be a credible threat that needs to be addressed in a multi-tenant system (like say, cloud providers).