Considering the recent "Spectre is here to stay" paper [1], can anyone comment on whether Firefox should be considered secure until the work on process-per-site lands (I believe they are working on it)?
The ongoing Fission work is basically defense in depth against future potential Spectre-like vulnerabilities.
No and Yes.
No, theoretically there could be spectre vulns. Practically we have seen zero spectre-based attacks in the wild. It's not a big deal.