Sure, but what is the practical risk of someone trying to target my Intel Nuc home server sitting behind my firewall with Spectre or Meltdown attacks?

Literally the official Spectre attack is via Javascript in your browser visiting a shady site.

it's nearly never someone targeting you, it's most times dining targeting thousands of arbitrary people at once

if you are especially unlucky the atack comes with you opening a website or similar

and honestly firewalls often only help against atacks against services with open ports running on your system, once they are in your system they have a lot of ways to circumvent your firewall (assuming it's a desktop system or similar, mainly not a single service system)

You’re grossly underestimating how difficult it is to pull off these exploits in practice. Even before getting to post compromise activity the adversary has to have a JavaScript VM escape, and also escape the browser sandbox. That shit is worth serious cash and nobody is gonna be spamming the internet with their precious zero days.

Even then you have to perform privilege escalation and map out the network. By this point you’re already pwned. The adversary isn’t gonna be looking for or even capable of pulling off a low level cpu exploit.

Sure but how many scripts are scanning the internet for exploitable Spectre and Meltdown vulns? As I understand it they are quite difficult to implement and execute at scale.