I guess I'm an old fart because I just assumed all this security type stuff was mostly done at the software level.

No, because you really don't want the software to have that kind of access. You could prohibit speculative execution outright, and eat the resulting cost in speed as you have to perform the calculations in strict start-to-finish order, but you can't trust the software to perform these calculations ahead of time and pinky promise to discard that work properly if it's not needed.