There's also the matter that they keep adding things to the list. Remember three years ago when we didn't know we had to worry about Spectre?
Minor nitpick, but "three years ago" the crypto world still did "worry" about Spectre and general transient execution attacks [1][2][3][4].
To me, the biggest thing about Spectre et al. wasn't the proof that CPU uArch can negatively impact security. Rather, it's the proof of information leakage from other processes and privilege modes, which is a drastically heightened vector than cryptography.
[1] https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/
[2] On Subnormal Floating Point and Abnormal Timing https://cseweb.ucsd.edu/~dkohlbre/papers/subnormal.pdf
[3] Predicting Secret Keys via Branch Prediction https://eprint.iacr.org/2006/288.pdf
[4] Exploiting I-Cache https://eprint.iacr.org/2007/164.pdf
I'd even go a step further and say a lot of the problem is that people don't even know about this as a thing to even consider thinking about. Unknown unknowns are the dangerous bit. Does this article cover every aspect of the things you need to consider? I know enough about it to say both I don't know and I highly doubt it.