Hardware-wise it seems to be doable now that more and more CPUs have MTE. (And secure processors exist, most OEMs outside Google/Samsung are just too cheap to add them.)

What does add ongoing cost is doing monthly driver/firmware/kernel/etc. updates. But IMO they should be required by law. Just doing the minimal ASB patching is not keeping your users secure.