Well, the A8 was vulnerable despite being in order but it was a mediocre design with an unusually long pipeline for a core of its class. Of course even in order core speculate a little based on predicting branches and their pipeline lengths but there's a very limited window for things to go wrong without going OoO and almost all in order cores can't execute enough dependent instructions to leak data without realizing they took the wrong branch.

Yes, to be more precise, anything doing anything speculative with memory.