JavaScriptCore uses indirect branches just as it did before Spectre.

Also, direct threading still means doing the same number of indirect branches as before, unless you implemented it as a tree of conditional branches. So direct threading doesn't change the Spectre situation one way or another.