Are you sure that s.th. called “secure boot configuration update” is delivered as a flatpak and not as a native package?
In the latter case the update command would be e.g. apt upgrade
on Debian based or dnf upgrade
on Fedora based systems, or whatever the package manager of the distribution is called.
It’s in the firmware category, i.e. it comes from LVFS. It’s neither a Flatpak nor a DEB/RPM/… package. Many of these, I believe are actually exe
files for DOS (happy to be corrected on this, it’s a while since I last read Richard Hughes’s blog).
Iirc, GNOME Software is plug-in-based and the Flatpak plug-in is just one of the plug-ins.