For regulatory compliance, that’s still not acceptable because it opens the door to cross user data access or privilege escalation.

If someone exploited a process with a dedicated unprivileged user, had legit limited access, or got in a container on a physical, they might be able to leverage it for the forces of evil.

There’s really no such practical thing as single user Linux. If you’re running a network exposed app without dropping privileges, that’s a much bigger security risk than speculative execution.

Now, if you were skipping an OS and going full bare metal, then that could be different. But an audit for that would be a nightmare :).