CPUs will only accept uploads of microcode if they can verify the digital signature, of which the private keys are only known to the CPU manufacturer (i.e. Intel or AMD). Probably it will also only allow upgrades, not downgrades, on a running system. So the only "attack" you can perform if you've gained root is to patch CPU security vulnerabilities by upgrading to a newer valid microcode, and then also only until the next reboot.