Are you sure that s.th. called "secure boot configuration update" is delivered as a flatpak and not as a native package?
In the latter case the update command would be e.g. apt upgrade on Debian based or dnf upgrade on Fedora based systems, or whatever the package manager of the distribution is called.
It's in the firmware category, i.e. it comes from LVFS. It's neither a Flatpak nor a DEB/RPM/... package. Many of these, I believe are actually exe files for DOS (happy to be corrected on this, it's a while since I last read Richard Hughes's blog).
Iirc, GNOME Software is plug-in-based and the Flatpak plug-in is just one of the plug-ins.
At least the Debian package depends on both, the library libfwupd2 and fwupd. So fwupdmgr should be present too (depending on how the used distribution handles these dependencies).