Hmm, looks like you are missing some crucial details, eBPF has the same mitigations to the CPU bugs in place as the rest of the kernel (e.g. retpolines on tail calls, index masking for arrays, sanitation of speculative store bypass, etc). Also, eBPF probes do not only work in the kernel but user space as well via uprobes as one example.