I'd need to see citations or a source test to confirm, because as far as I can tell, it is exploitable on x86 on any OS.
Well you can some ideas about proofs of concept code here,
https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.htmlBut think about it. What are you trying to protect? You're browsing history? Any process can read files on the disk and history is not encrypted. Your logins? They are encrypted on the disk and in the kernels disk cache memory, other then that they aren't in kernel memory. they may be in the browsers memory, in which case any JavaScript flaw can be used to read them as they're all in the same process. Another program could use Spectre to read a different processes memory.
So a malignant program could in theory read the browsers memory, it is going to have to be an OS/2 program that you run, possibly through trickery. Who is going to go to the trouble to write a malignant program and target you? Quite likely due to timing problems, the code will have to target your exact CPU, which I believe you've mentioned is an old one.
If you're really worried about security, there are easier flaws in our discontinued browser to exploit, often using cross platform code such as JavaScript. Much easier but even then you often get code trying to run C:\Windows\cmd.exe and failing on OS/2.
If you're really worried about security, you should run one of the BSD's and even then there is a risk of a zero day exploit.
The real worry is someone targeting your bank, a much richer target.