So remember that it's one core (physical) acting as if it was 2 (virtual). Each of these vCores could be assigned to separate workloads on a server. But because it's ultimately one core, threadA could possibly access data in threadB. If A was a different entity than B, then entity A could access entity B's data.

It's more that CPU architecture is insecure in general.

But so is literally everything when you go down the deep dark rabbit hole of all the tech we use. Meltdown, Spectre, rowhammer, VMScape. The one where they can figure out your password from the sound of your keyboard while you're on a zoom call.