The security holes have nothing to do with AMD's Ryzen release, security has overall become a bigger concern and some researchers decided to look into branch prediction, etc.
Though Intel hasn't had a major overhaul in architecture since Nehalem (and to lesser extent, Sandy) and they've mostly just done minor optimisations, like rely heavily on making branch prediction more intelligent. So as such they got hit harder - not even Ryzen was developed late enough that they would've been aware of Spectre's school of vulnerabilities early enough to specifically design around them.
Physical access isn't relevant, ability to run your code on the machine is. This, at some point, was doable with JavaScript, until browsers mitigated against such attacks with reporting timers less accurately.
And overall the effect of these vulnerabilities on any desktop oriented task is rather minor, database operations got hit the hardest.