I don’t see any indication that the untrusted workload could extract data from another _unwilling_ workload.

Side channels exist; but it doesn’t mean that all of them are a security risk.