This was originally discovered in #104, and there's also a workaround there.
The ReturnDirection pass detects when it's safe for a function that returns something of unknown type to return it by (derived) pointer instead of by copying to an out parameter. For some reason this doesn't kick in for vector indexing. My hunch is that this is causing us to generate code that LLVM's optimiser doesn't easily see through, meaning that we don't get the constant-time goodness we would want.
This needs to be investigated and fixed if possible.