In contrast, I prefer starting the kernel on a cpu that doesn't have known microcode bugs, which implies doing the upgrade earlier, be it in firmware or bootloa

In contrast, I prefer starting the kernel on a cpu that doesn't have known microcode bugs, which implies doing the upgrade earlier, be it in firmware or bootloader. Fortunately, fwupd, together with UEFI capsule, can make upgrading firmware very easy and safe. Ideally, a CPU wouldn't have to get that many microcode updates anyway.