Microcode updates are distributed as OS updates.
EDIT: So looking into it, it seems that CPU microcode is indeed the firmware, and I presume that the firmware is where a fix such as the one released here would be.
Somebody mentioned a Lenovo update elsewhere in comments. The recent ME updates required an update from Lenovo. I assumed the same would apply here but thankfully not. I wonder why the OS can't update ME firmware the same way.