Yes, it's too risky to make CPUs without microcode. Being able to fix bugs, or at least disable things so you don't have a complete paperweight is still important even for ARM.

Disabling things can be done through "chicken bits" on configuration registers, no microcode necessary.

Do you know of any ARM cores used on smarphones which actually have updatable microcode? I've never heard of any. All errata fixes I've seen are of the "set this bit in a specific register" kind.