They didn't write the firmware. QMK is a popular open source keyboard firmware.

And fwiw, user updatable keyboards are usually configured require a particular key be pressed to flash it, or have a dedicated button to hit with a paper clip.