You're confusing the vulnerability related to management engine firmware with the other latest ones requiring a microcode update. Microcode does not come in ME firmware. Yes, microcode and ME firmware (two separate things) are generally included in bios revisions. However, if you don't get current bios support for whatever reason,. You can obtain the latest microcode via Windows update. The catch with the latest revisions is that MIcrosoft has only made that update available to the preview ring on the may feature update, 1903. Most of us are on 1809 and as of my last check yesterday, they're withholding updating that version. Probably to get more people to upgrade versions quicker when the feature update rolls out soon. It is a manual update that you have to download and install, it does not.come automatically. Technically if you apply all the ME Firmware, the MEI driver, and the microcode yourself, you don't need to rely on bios support, although that is optimal I suppose.
This is the 1903 update you can get the microcode in
https://www.tenforums.com/windows-10-news/132689-kb4497165-intel-microcode-updates-windows-10-inside...But If you're on 1809 like most of us, it would be this one which is not get updated with the current microcode (Ms updates it, but keeps the update number the same
https://www.tenforums.com/windows-10-news/122479-kb4465065-intel-microcode-updates-windows-10-v1809-...
