Except modern ARM chips are actually CISC too. Also microcode isn’t strictly RISC either. It’s a lot more complex than you are thinking.

There are some RISC characteristics ARM has kept like load-store architecture and fixed width instructions. However it’s actually more complex in terms of capabilities and instructions than pretty much all earlier CISC systems, as early CISC systems did not have vector units and instructions for example.