That's true -- but "the program" is also any code using yours as a middle-step, which is the case of a network service is a huge number of people. So anything that requires total program control rather than subroutine enforced safety is a nonstarter.

The timing may occur outside of your control, and then statistical profiling used. If the timing of a reponse to a network request has a time component that depends on shared load, then you have a side-channel.