"Everybody" who has some knowledge in security (espcially with respect to side channels) knew from beginning that these CPU features were a ticking time bomb in terms of potential side channels.

What was unclear was how this (at this time played down by CPU vendors) potential threat could be used to create real attacks.

Going from potential threat (that "everybody" knew about) to real attack is the central achievement of the authors of the Spectre and Meltdown attacks (and their successors).