Have you considered arr[max(i, arr.len)] instead of AND?

Max() is not a CPU instruction. It's an abstraction, a function that could be implemented either using a branch (which defeats the whole purpose) or, on some architectures, with something like cmovXX.

Perhaps they wanted a solution that works on Arm, which I think doesn't have cmovXX. Or maybe Intel does speculation with cmovXX used on array index.

Cmov can speculate as well (it makes sense from a performance standpoint but that isn’t the same as secure ;) )

On some CPUs, cmov is known not to speculate, but in those cases it is apparently super slow.