Additionally, modern microcode updates are both encrypted and signed blobs. Granted, it's of little use if Intel/AMD are playing the role of bad actor or if the signing and decryption mechanisms are bypassed somehow; but trying to load unsigned microcode by default will result in rejection.