All element-timing and LCP performance entries would have a non-zero renderTime, even if they are cross-origin without Timing-Allow-Origin. All presentation timestamps (renderTime, paint timing start time, event timing end time) will be coarsened to a 4ms multiple to mitigate the risk of reading cross-origin image information.
Element timing and LCP entries have a "renderTime" attribute, aligned with the first frame in which an image or text was painted. This attribute is currently guarded for cross-origin images by requiring a "Timing-Allow-Origin" header on the image resource. However, that restriction is easy to work around (e.g. by displaying a same-origin and cross-origin image in the same frame). Since this has been a source of confusion, we instead plan to remove this restriction, and instead coarsen all render times by 4ms when the document is not cross-origin-isolated. This is seemingly coarse enough to avoid leaking any useful decoding-time information about cross-origin images.
Explainers: https://github.com/w3c/paint-timing/blob/main/presentation-timestamps.md#security--privacy-self-review