You still need to compromise ME, at which point there are a million easier ways to accomplish your goals than a microcode patch. For example, SMM is much easier

You still need to compromise ME, at which point there are a million easier ways to accomplish your goals than a microcode patch. For example, SMM is much easier to compromise and arguably more powerful (you can hide large amounts of code in SMM, not so in microcode); SMM backdoors that interact with userspace code have already been demonstrated. Or you could do something in ME directly, which again has plenty more space to hide stuff in than microcode. The point is this isn't a bug, it's a feature; if you've gotten the CPU into red unlock anyway, you are already thoroughly screwed. This is like saying if you install a development version of an OS and enable remote debugging, you can take over the machine remotely. Well.... yes. This is interesting because it's undocumented, not because it has security implications.