These cause a 10%-20% performance drop and I see no reason to enable them on a desktop. They can be turned off using mitigations=off on your grub command line.
Anyway, modern chips have hardware fixes, these microcode updates and kernel retpolines etc. should be less impactful if your CPU was made post-meltdown.
Converting random bits into meaningful data would seem to be the sticky point.
The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company.
There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.