The "Retbleed" speculative execution vulnerabilities

True, but I could imagine the CPU reacting to having a shadow stack by predicting that nothing will alter the shadow stack, and knowing that the shadow stack is a good way of refilling your return prediction buffer if it had overflowed previously.