Retpolines for Spectre, and PTI for Meltdown, are still in the kernel. Linus doesn't have too much disagreement with them. It's the IBRS / IBPB code for Intel's CPUs that Linus has a problem with.
Also, not everything can be mitigated in microcode, for many reasons, not all of which I understand myself. Sometimes, only a fundamental hardware-redesign can fix the issues proper.
Doing otherwise would throw the onus onto kernel maintainers for Windows, Linux, and the various BSD distros, and they don't want a crapton of one off fixes for the plethora of CPU errata that Intel and others patch in microcode.
Edit: s/Intel m/M/
Compiler has large effect. Common operations like CALL and PUSH go trough microcode even in m64 but there are alternatives. Many floating point operations have assists. Nonoptimal memory alignment might go trough microcode.