The microcode rc.d script starts very late in the boot process.
Rescan of cpu flags must be triggered after loading microcode which is currently done in the rc script. By this point in the boot process many decisions may of been made based on the previous flags.
Intel microcode updates happen one cpu physical core at a time. Leading to potential moment in times different cores have different microcode updates.
On resume from suspend the microcode needs reloaded. This can be done via rc.resume but is not currently setup.