less than one percent of active devices are running it.
Are there any other sources for this number? 'Cos most devices i deal with are in the jelly bean - lollipop range.
Even if, a company such as Google could perfectly well keep maintaining older devices, but then they wouldn't be able to sell Pixels and boast how eco-friendly they are.
I'm sorry, what? Setting min SDK is, itself, a patch. I'm sure Google could backport that patch if they so desired. It's not Spectre, it's a software vulnerability.
There's no technical reason not to provide security backports to software. This is intentional.