Even of you can detect effects of speculative execution it does not necessarily mean that it is unsound, because the program still functions as expected.

It is however not secure in many cases, but I also think that newer implementations do better in this regard so it is probably not a fundamental issue.

And about targeting microcode directly, that would be a new ISA which is not desireable and also decoding instructions is not that big of a deal compared to the rest of the core so it is not worth the hassle of switching ISAs.