Regarding https://tc39.es/ecma262/#sec-typedarray-create-same-type there's a marking for user-code on the second step

2. Let result be ? TypedArrayCreateFromConstructor(constructor, argumentList).

The constructor is chosen from the intrinsics list, while argumentList comes as a parameter.

If I'm not badly mistaken, this could call user code only if argumentList contained a user-provided iterable value, but at least all of the in-spec call sites always pass in << F(len) >>. Would it thus be correct to change those call sites to not have UC marking on them, since we know statically that they'll enter the 6.c Else branch of TypedArray(...args) with a number that will not call into JavaScript from ToIndex(firstArgument), thus just calling to AllocateTypedArray where the only UC would happen from getting constructor.prototype which is likewise statically knowable to be the %TypedArray%.prototype as that's an unconfigurable, unwritable property.