STM32 Flash mass erase from IAP
The program might not be running from flash. The STM32 can run code from SRAM or external memory (via FMC); code running from these locations could safely* erase flash memory.

Some STM32 parts also have two banks of flash memory. Code could be running from one bank and erasing the other bank.

*: Well, mostly safely. A power failure during an erase/program cycle would leave the part blank.