So the UUID could be used as an imperfect indicator of a records created time?

UUIDv7 but not UUIDv4.

I suppose timing attacks become an issue too.

UUIDv7 still have a lot of random bits. Most attacks around creating lots of ids are foiled by that