Some security issues require software patches but those CPUs also include hardware improvements which strive to reduce overhead to negligible value.
According to Anandtech [0] only Spectre V1 requires pure software mitigation.
[0] https://www.anandtech.com/show/14664/testing-intel-ice-lake-...