Should all kernel patches for CPU bugs be unconditionally enabled? Vs Performance vs Applicability

[Patrick]

Related:

Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)

Also, is Whonix vulnerable beause it hasn’t installed CPU microcode updates to address speculative attacks? That is, the package update is only available from Debian non-free repo? See here: Debian -- Security Information -- DSA-4279-1 linux From memory, I only saw this update happen in Qubes Debian 9 TemplateVM and not Whonix-14 ones.