This probably doesn't contribute to the conversation but with the number of serious vulnerabilities that have popped up recently I'm not inspired to solve the truth table for the CPU vendor that leaves me the least exposed. As others have said - and I have seen - some of these can be exploited with Javascript in the browser. (I do not know much about Zombieland presently)

Looking forward to a less complex architecture even if it means cutting me off at the knees with execution speed (for a few years):

RISC-V