(AFAICT. I'm not very well versed on some of this stuff)
We use the scribunto extension (aka LuaSandbox php extension) to provide lua scripting on our sites.
I believe this uses luajit so that lua runs jit-ed in the same process as php.
Additionally (as pointed out by Tim Starling), lua supports a high resolution timer in the form of os.clock(). (In fact LuaSandbox overrides the default os.clock() to provide a higher resolution timer). Tim says the precision is 1µs.
So maybe a similar issue might affect our Lua implementation.
[Note, the other MELTDOWN/SPECTRE bug is T184256]