How FPGA firmware writes in flash?
First of all, the whole point of JTAG is that it allows test software to manipulate the pins of the device in order to test their external connections to other devices on the board. The ability to manipulate the internal state of the device is a secondary function. So, it should be obvious that it will be possible to cause the pins to execute the protocol required to write data to the flash.

However, that tends to be rather slow in practice, because of the large number of JTAG transactions required to perform a single flash write. Therefore, most development systems download a small, fixed design to the FPGA whose only purpose is to write to the flash, and then they transfer the configuration data to it using a more efficient protocol (still over the JTAG interface).