Does it Pay to Defend against a Speculative Attack?