I had the pleasure once to debug a problem that happened if the user put their computer to sleep and switched it on again after 40 to 50 seconds. Less than 40 or more than 50 seconds, and the problem wouldn't happen. (The 40 or 50 seconds were on the hardware that I used, the times might have been different on other hardware).
This was caused by memory cells keeping their data for a while while the computer was put to sleep, and eventually losing it. After 50 seconds, everything was gone and the software handled that fine. After 40 seconds, only some cells lost their data. Enough cells had the old data to convince the software to continue assuming it had valid data, but enough cells had lost their data to make things crash.
So yes, sometimes you need to go below the microarchiteture level. And as D.W. said, attackers may go below that level, and then a defense must go below that level as well. (I heard of attacks against Java Virtual Machines that basically consisted of flipping a small number of random bits using radiation. Plus a lot of complicated details, but the main attack was using radiation).