Massive is a pretty strong word. Unpatched vulnerabilities, perhaps, but AFAIK most of those are of the "you can potentially read memory if you already have local execution" sort, which is unlikely to matter for an internal server (i.e. not running untrusted code, or likely even being exposed to untrusted clients). Depends on your threat model, of course.

I'm fairly certain that the T430 got a bios update for Spectre, there's Intel microcode updates that can be loaded at boot, and other general mitigations for CPU vulnerabilities in the Linux kernel as well.

Nothing's impossible, but it would have to be a pretty targeted attack to exploit the CPU.

That said it's still a good idea keeping stuff behind a VPN if you don't need to share stuff publicly with the entire internet.