Interesting, the conclusion only speculates that this can have security consequences. Anyone with better understanding that could provide an example of what would be possible to do using these instructions?
It should be possible to see if a given "secure" binary makes use of a given microcode instruction. If that is the case, it could be possible to use udbgrd/udbgwr to modify the microcode instruction to do something else, e.g. to store some register data in the URAM or the SRAM. By doing this you should be able to "spy" the data the "secure" binary is processing.
anything! if you can get them to execute. the authors found one way to enable them, but others may exist (we do not know). maybe another secret instruction enables these also. we do not know.