They probably have the hardware run in USB-Serial mode (rather than the usual USB-HID mode of controller, keyboards and mice which has no capability to upload any significant data - beyond LED status - to the device) and then just push the firmware into the Serial Device their hardware appears at in that mode.

Chrome supports letting websites remotely access Serial devices on the host PC.