Browsers have put in patches for Spectre. I turned off Spectre and Meltdown in my OS because I wasn't willing to live with the performance hit for a scenario that is unlikely to befall me. I think it's fine if the Mac Pro is using a completely up to date browser and isn't installing new random applications.