To be more precise, running different cloud customers on different SMT threads of the same core allows them to attack each other.

This is also the case with Spectre-related vulnerabilities such as L1TF.