Even a very low penalty isn't something that the industry is willing to produce..
For example, the RISC-V is derived from the MIPS, the MIPS had some instruction to trap on integer overflow, it's a very minor penalty to have these instructions, and guess what? They haven't been included in RISC-V..
Except that as soon as you have two instructions instead of one, people starts talking about cache pressure and turns off the safety.
Optional security == no security.
For example, the RISC-V is derived from the MIPS, the MIPS had some instruction to trap on integer overflow, it's a very minor penalty to have these instructions, and guess what? They haven't been included in RISC-V..