The first ARM was microcoded.[1] The DEC Alpha used microcode (nee PALcode) for a number of functions. There are RISC-V implementations using microcode.[2]
Not all CICS chips use microcode. Indeed, you can make an argument the 6502 and Z80 don't have microcode rather a ROM sequencer. Depends on how fine you want to grind your axe.
Second, it is totally normal, when production get non-ideal product, but lot of compromises.
Whole idea of CISC, it have relatively simple hardware, but many thing made under the hood by software (microcode), because of this for CISC is normal commands lasts more than 20 cycles (in PDP was commands with 48 cycles), while others could be 3-8 cycles.
RISC avoid long operations. Even more, whole idea of RISC to made hardware extremely straightforward and unified, so ideally ALL commands work with same count of cycles.
But remember about compromises. Power of CISC was that it's microcode could been updated much easier than RISC hardware, because of this even for some IBM, sure CISC processors exists option, to create for EACH client unique CPU with its own opcodes.
Sorry, even more - for some IBM processors was possible to load new microcode on boot time, and they even build on this their line of mainframes, in which in top machines nearly all standard opcodes was hardware supported, but in cheapest machines, most things calculated by microcode.
For RISC, yes, exists also for ARM option, to include client opcodes, but this was totally different time and totally different price.
Not all CICS chips use microcode. Indeed, you can make an argument the 6502 and Z80 don't have microcode rather a ROM sequencer. Depends on how fine you want to grind your axe.
[1] https://www.righto.com/2016/02/reverse-engineering-arm1-proc... [2] https://github.com/gsmecher/minimax