Of course the mitigations get disabled.

What's the threat model where your HFT application's running hostile / untrusted code?

I'd like this stuff enabled on my desktop because I'm not sure what hideous javascript is being dumped into my browser by some advertising network.

But my trading platform? If the badguys are able to execute these attacks there, it's because they've got full access already.