What capability or features are needed to make a module programmable?
Many SPI-interfaced peripherals including the nRF24L01 actually do not contain a stored-program processor.  Instead they are more hard wire logic - state machines, etc.  It's actually a little tricky to implement an SPI peripheral on a processor - it can be done, but its conversely a very natural fit for a finite state machine to expose a bunch of registers over SPI which control the operation of other FSM's that do the actual work of the chip.

Of course other devices do, for example MEMS sensor ICs may have an on-board processor even capable of running custom code.

There are also a lot of fixed-function devices that are clearly acknowledged to have firmware, but where the end user isn't allowed to change it (at least beyond loading a new binary from the vendor).  Sometimes you can reverse engineer these, sometimes easily, sometimes only with extreme difficulty.  These would include things like radio + MCU combinations implementing some radio protocol.

And then there are components where the fact that they have firmware is little discussed, almost secret.  Most USB-interfaced chips presumably have something like an MCU inside, there have even been suggestions that some USB-serial parts are just re-numbered generic MCUs.  But the firmware of such devices may be not just non-alterable by a customer, but actually immutable, for example in a mask ROM or one-time-programmable technology.