Nothing older than Nehalem and Bulldozer got microcode mitigations for Spectre, so I'd say running a C2D online would be a liability by now.

…IF anyone really bothered to develop exploits against something practically no one uses anymore at this point.

I am still waiting to hear about a proven exploit in the wild for all that stuff we’re mitigating against.