That's one, but another scenario you forgot about is one where researchers would just fuzz the microcode update mechanism to try and figure out more about how the insides of the processor work. If you could get the processor to recognize your microcode updates as valid, you could determine information about how the processor deals with microcode internally by observing what changes after you send different update sequences.

Intel protects their trade secrets pretty fiercely and they don't talk about the processor's internal microcode representation. As much as many of us would really like them to let us know what's really going on inside there.