Are you sure that s.th. called “secure boot configuration update” is delivered as a flatpak and not as a native package?
In the latter case the update command would be e.g. apt upgrade on Debian based or dnf upgrade on Fedora based systems, or whatever the package manager of the distribution is called.
It’s in the firmware category, i.e. it comes from LVFS. It’s neither a Flatpak nor a DEB/RPM/… package. Many of these, I believe are actually exe files for DOS (happy to be corrected on this, it’s a while since I last read Richard Hughes’s blog).
Iirc, GNOME Software is plug-in-based and the Flatpak plug-in is just one of the plug-ins.
I think GNOME Software uses some fwupd library rather than the straight-up command-line fwupdmgr, but yeah, basically.
