As I've mentioned before, we shouldn't be surprised about new attack vectors for these timing attacks, as long as there is an underlying weakness, there is a potential for more undiscovered attack vectors.
Still, for desktop users risks will be very low as long as the malicious software has to be run locally, and for e.g. the Spectre variants where it's more like a theoretical possibility than something that would be practical to actually steal useful information.
I would advice against participating in "schadenfreude", just because these specific attack vectors are Intel specific, doesn't mean others are not affected by similar problems. We've see in the past how vulnerabilities from Intel has led to discoveries of similar problems in other designs, not only AMD, but also the huge spectrum of ARM designs in existence. We should not assume they are "invulnerable" to this class of attacks just because we haven't found anything yet, we can't know that with a reasonable certainty until they have been carefully vetted. Hopefully the last two years of discoveries will lead to more consciousness about designing for security in hardware, something which seems to be largely "lacking" until now.
Once again we see both speculative execution and SMT as elements of vulnerabilities. It's important to emphasize that none of these are flawed in principle, but have certain security implications that people have either ignored or been unaware of. Speculative execution have certain pitfalls by itself, but have magnitudes more once SMT is put into the mix. While it's still possible to actually do this securely, the pitfalls of SMT will only increase with architectural complexity, and the cost of dealing with this does too, and since the performance gains from SMT are diminishing with increasing IPC, SMT should be abandoned sooner rather than later. One interesting side-note is that recent rumors of Zen 3 claim support for 4-thread SMT, which would if true increase the potential pitfalls even more.
Most, if not all of these require the attacker to already have access to a machine, and in many cases a whole lot of additional conditions have to apply. Another unrelated example would be the much hyped AMD vulnerability of flashing unsigned BIOSes, which still required root access and/or physical access.
We should never assume a single security measure is impenetrable by itself, and instead build security in layers, where multiple vulnerabilities are required to execute a successful attack. Doing so have been established as good practices for ages, but times are now actually changing for the worse, as companies are moving more and more of their essential infrastructure into the public cloud, where a single vulnerability in either hardware, hypervisor or the cloud management is enough to bypass any security measure. All of a sudden, we have just a single line of defense against the attackers. I'm just hoping this cloud hype dies down before some major incident occurs.
</rant>
