Could you outline/bring clarity to why that is totally unimportant for many use cases?
I suppose most uses of the RBP don't involve running 3rd party code.
Although, I do think this is an important issue to address.
In most cases RPI will not be used as a host on which many VMs from different customers will run. Many embedded systems will not have browser with JavaScript enabled. And so on...
Because there are still, over a year later, no reported cases of any spectre/meltdown vulnerabilities actively being used in the wild.