There's indeed a lot of firmware (not just microcode). A bunch of code is signature-checked and executed from the boot ROM and firmware flash in order to bring up the CPU and its various auxiliary cores (starting with the security processor/management engine nowadays), the PCH and the DRAM controller - all before the CPU can start executing any bootloader code from RAM.