@cascode yeah, i guess that's kinda the thing.
like. when people are like "oh, but we should use z80s, those're safe."
or, heck, we should use Power architectures or whatever.
you can implement those to be vulnerable or not vulnerable. the ISA doesn't ~care~.
so you gotta be thinking about that, or you'll inevitably fall into the same situations? i think?