The Meltdown/Spectre vulnerabilities are on the CPU chipset design/architecture, and short of buying new future hardware, the patches are a nice illusion of security over the long term. New methods of exploiting the flaws might surface over time that are able to bypass the current patches.
In short, the current software patches/microcode mitigate the problems against known methods of Spectre/Meltdown family of exploits, but do not solve the underlying CPU design problems that allow them in the first place. The affected (several generations) of CPUs have not stopped being vulnerable in the long run (and most probably never will).
However, as @Gilles correctly states, having that warning does not mean the current known exploits Spectre/Meltdown methods will work; they won't work if the patches are installed.
In the case mentioned in the question, the kernel is only checking for the CPU models known to be affected by Spectre/Meltdown (all x86 CPUs for now if we are talking only about x86), and hence the
cpu-insecure still being listed in the bug section/line in
Go check your
/proc/cpuinfo. It will contain cpu_insecure if your
kernel has the KPTI patch
I've found that the KPTI patch has this piece of code:
/* Assume for now that ALL x86 CPUs are insecure */
And after the kernel update, you get:
bugs : cpu_insecure
PS. There was already a round of updates for a new method for exploiting the Spectre/Meltdown "bugs". It probably won't be the last time.