Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.
I thought this was all down to an implementation detail and has nothing to do with ISAs.
> the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
> [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]
Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.
For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.