Before we go to hard facts, let me voice my opinion that your comparison between viruses and exploits for Spectre and Meltdown are a bit skewed: there are >1 million viruses out there and no exploits for Spectre and Meltdown at the time of this writing: only Proof of Concept (PoC) code, but the NSA, CIA,BSI, ФСБ and other three-letter organisations are very probably running overtime now to come up with exploits.
Secondly, risk cannot be taken into account all by itself without talking about impact as well, so that's why I added that to your question.
Now onto the hard facts:
- Today the number of exploits is 0 (as far was we know), so the risk is low.
(Cost: high. Benefit: Low)
- In the future, the number of exploits will increase, so the risk will increase linearly.
(Cost: High. Benefit: Medium.)
- If you would decide not to implement the patches, and you would be hit by an exploit in the future, the impact will be high as this is a side-channel vulnerability
(Cost: High. Benefit: High)
- If you would be running in a virtual environment with Ubuntu as the host system, the impact would be very high as the VMs on the same physical host would be able to inspect each other's memory...
(Cost: High. Benefit: Extremely High)