It's probably by far the largest vector for untrusted code in the world.

If its sandbox guarantees are broken by Spectre then the case for allowing it to run on one's machine becomes much weaker.