It’s tiring going over the same arguments over and over again, and I can
only suppose at this stage that you are trolling.
Here we are talking about microcode and firmware: Qubes includes both.
If there were free packages available Qubes would include them by
preference.
Your argument is flawed because the first premise is faulty.
There is no evidence that including non-free microcode is a privacy and security
risk per se.
There is ample evidence that not including non-free microcode is a privacy and security
risk per se.
Just because Qubes is a security distro it will include microcode
updates.
Because Qubes wants to make installation easier for many users
it includes some non-free firmware. (Debian has recently endorse this
approach.)
That’s all.
If you prefer a distro that does not include microcode updates and hides
from the user the fact that they are then open to well known attacks,
use an FSF endorsed distro.
You’ll be less secure but that’s not your main concern.
When I comment in the Forum or in the mailing lists I speak for myself.