There's no conceptual vulnerability if the system the chip is being integrated into isn't multi-tenant (where a "tenant" can be a literal time-share user, or something like a website's Javascript code executing in a web browser.)

So: cloud computing, and consumers that might be running dumb code from the internet (= i{3,5,7} and Xeon = volume production) should get chips with no hyperthreading; while HPC, locked-down workstations, and gaming PCs that probably don't have any important data on them (= i9 = low-batch-size production) should get chips with hyperthreading.