Then I wonder... how do these devices get flashed the first time? Not by USB apparently, but by JTAG or something?

I had a pc mainboard once, during the Pentium 60-days, which had a flashable BIOS, but which also had a 4K bootloader in mask ROM, e.g. indestructible. Even if you managed to mess up during flashing a new BIOS, like overwriting it with zeros, you could always restore it by diskette, thanks to that 4K bootloader.