The Machine Is a Lab, Not a Workstation

Security work is mostly virtualisation. A target host, an attacker box and something to capture traffic between them all run at once on the same hardware, so memory capacity and processor threads set the ceiling on how much of a lab you can stand up before anything starts swapping to disk.

The second half of the decision is firmware. Hardware virtualisation extensions, the IOMMU, TPM 2.0 and Secure Boot all live in settings a manufacturer may ship disabled, and they interact with each other in ways that decide whether your hypervisor of choice starts at all. Those details matter more here than the processor tier on the box.