Yeah but you mentioned Spectre. It’s not clear if you can do a Spectre attack on an interpreter. Maybe you can, but it seems super hard and not practical.

And without Spectre, the argument for site isolation is much weaker.