The allusion to Spectre seems odd to me too. This really has nothing to do with Spectre, other than it (sort of?) being a side-channel attack. So Google's Spectre mitigation not "fixing" this isn't surprising.
What the paper did was related to the site isolation, and not Spectre, but there was a lineage there...Spectre -> Site Isolation -> This Side Channel attack still works.
They showed that while Google said "single site", they really meant "same tld, but hostnames can differ" and "if you have control over a page on b.whatever.com, you can artificially gain side-channel visibility to c.whatever.com" via window.open() or iframes and some memory pressure.
Seems fairly significant given that many sites have user generated content on a.example.com and more important/sensitive stuff on b.example.com.
That is how "site" has been defined in the web world (compare to "origin").
For example, consider the SameSite attribute on cookies, site is also used there to mean same tld different hostname. So its not like google made a slip. They've been using this nomenclature consistently.