I couldn't find it in the article if it was addressed, but I'd like to see 2017-era microcode used in the mitigations=off testing as well, to see how much of a difference that makes.
I also wonder if there are changes to the kernel that can't be reversed with a simple mitigations=off and what effect compiler-based retpoline hacks have these days. Wouldn't be surprised if there's some other variable that I'm missing.