No the vulnerabilities could not have been found by reading the manual. The researchers had to reverse engineer how branch predictor aliasing works for example.

I recommend reading the Google project zero blog post on them - they're easy to follow.