[the_why_of_y]

The issue with Meltdown is about an OS process reading other processes' (or kernel) memory - this is caused by the CPU not enforcing its protection boundaries properly and is mitigated by CPU microcode or firmware updates.

The issue with Spectre is about an OS process (or kernel) reading its own memory - this is why in contrast to Meltdown it can't be fully fixed by CPU microcode or firmware updates, it requires mitigation in any code that enforces security boundaries, such as kernels or sandboxing VMs.