Oh, that's a good point, you could even determine that your hypervisor doesn't touch any changed microcode paths, and just pause the VMs, take the update, and unpause. (Still seems... brave, maybe? Or at least involves more information that I'd expect anyone outside of intel to actually have, I guess.)