A better source for these changes are the two merge window roundups from LWN:
Memory allocated with memfd_secret gets removed from the direct map, which means that from any other process's address space, there is no virtual address (regardless of memory protection) that corresponds to those physical addresses. So any exploit that gets only gets you memory read/write but not kernelspace code execution (various types of wild pointers, etc., as well as whatever exciting speculative execution vulnerability will undoubtedly show up next year) cannot compromise the data in a memfd_secret mapping.
That's an odd assumption. There are still a lot of universal tricks for turning a truly arbitrary R/W primitive into code execution, e.g. just write to the page table.
OTOH, this does guard against arbitrary read primitives, which, as you mentioned, is especially useful in post-Spectre days.
e.g. if you had a sidechannel that leaks data from the kernel, the kernel can't disclose data that it can't actually read.