BPF is runtime-bounds-checked in practice. Eliding a few checks here and there is not significant.

> The instruction limit stops the verifier from having to solve the halting problem. The guaranteed runtime limit seems to be a secondary benefit.

BPF now has unlimited loops with the help of iterators. Even without them, it has access to string instructions, so you can easily make programs that take seconds to run. That's why BPF had to add asynchronous termination support.

As keep I saying, they should have just taken WASM instead of reinventing the wheel. Badly.