I think you can still be secure on the net with the Spectre and Meltdown mitigations disabled on a personal system. If your browser is current, it already has mitigations built into it. Are there any mathematical calculations showing the risk % of disabling mitigations? Or is this just herd activity where everyone sets it as a default because they don't want to accept the liability for the remote chance of lightning striking?
This is dangerous, and maybe not in the way you expect.
Personal systems are running a lot more untrusted code than, for example, servers.
Mitigations are more necessary on personal computers than on servers.
As for "it's mitigated in the browser", the issue is that there's no "one" mitigation for anything, you have to mitigate it on the OS, in the browser, in the microcode for the CPU. Everything. You can't just apply one mitigation and be done. FWIW the "mitigation" in browsers was to disable high precision timers; which seems to be making its way back, and was never necessary, it just made the exploit easier.
I highly recommend keeping mitigations enabled for personal machines; when it comes to servers with a decent WAF that are not shared amongst users that can run code: disabling mitigations makes more sense. (dedicated databases, for example).
Someone described the mitigations as: "Surrounding a drunk person with trampolines in the hope that when they collapse they will be corrected into the right position", I think this is the most apt example I can think of.
For personal systems that run a lot of untrusted code (due mostly to the web): I wouldn't personally advocate for removing a trampoline.
