Until then (and that will probably take a while obviously) it's probably going to be a cat and mouse game. I would expect a lot of patching. Future discoveries probably won't have the luxury of a 6 month coordinate / fixing window.
On top of that this is drawing a lot of attention to a particular area which will likely have a snowball effect as more and more exploits are found more and more will search for them.
Finally, If the mitigation strategy is 'don't let a javascript application be able to accurately know how much time something takes' and for 25 years that has not been a serious fundamental design consideration (quite the opposite to the point that a super accurate one was given freely in the form of `performance.now`). It seems like this is one big messy ball of yarn to untangle.