I'm fairly certain that the T430 got a bios update for Spectre, there's Intel microcode updates that can be loaded at boot, and other general mitigations for CP

I'm fairly certain that the T430 got a bios update for Spectre, there's Intel microcode updates that can be loaded at boot, and other general mitigations for CPU vulnerabilities in the Linux kernel as well. Nothing's impossible, but it would have to be a pretty targeted attack to exploit the CPU. That said it's still a good idea keeping stuff behind a VPN if you don't need to share stuff publicly with the entire internet.