Soller: Real hardware breakthroughs, and focusing on rustc

That's true, though I think unused code (whether vulnerable or not) can still be useful in exploits when there is a vulnerability in the actively-used parts of the program. A buffer overflow bug might allow a ROP attack, but the attacker needs to find suitable ROP gadgets somewhere in the process's address space. And some Spectre variants trick the CPU into speculatively executing code at attacker-controlled addresses, but that code must contain a gadget to exfiltrate data from the speculative world. If the application is statically linked and the dead code is removed, it becomes harder for an attacker to find suitable gadgets. (But in practice I guess this is only significant for small applications that use large libraries; if it's a large application then it'll probably have enough gadgets already.)