I don't buy the argument that having a bunch of vendors extend the ISA makes it more secure. I think we would end up with an ecosystem with a lot of custom extensions and functionality that will end up exposing more attack surfaces and that would make it difficult to know if your device is affected or not.