The ask matters for the "rogue model" story, but I agree it should not be the whole story for isolation. Two cooperating tenants who both want a channel is a much easier problem than one VM stealing from another that is not playing along, and several people downthread already draw that line. What still bothers me is how little hardware you needed once both sides were willing: a shared cache was enough, and that design is the default, not an exotic bug. If the threat model is only "uncooperative neighbor," this demo does not break it. If the product claim is "these VMs cannot communicate," it does.