One of the purposes of having an OS is that it will talk to the devices that the user space is not allow to talk to. For example, even printing to the screen is talking to a device that your application space does not own. Your application space program will make a call to the OS saying something like "please display this stuff" and the OS will do it for you.
In the case of updating firmware, you call a service which is there to perform the update for you. The device where the firmware is stored is usually a chip of a device type called "flash memory". This chip is hard to write to, but it can be erased and reprogrammed if you know how and have proper access privileges. The OS will call a driver which is there to serve the OS, and knows the specific details of the device it is supporting.
So you call the OS service, and give it the new firmware image which you downloaded from the manufacturer. The image is usually cryptographically signed so that the OS can determine that it really came from the manufacturer and has not been modified, which means that it is safe to use as the new firmware. After checking that the image passes the signature test, the OS can erase a portion of the flash memory, and re-write it with the new firmware.
Also, it is likely that there will be a backup copy of the firmware in the flash memory which can be used in case something goes wrong during this process.
For example, if you power off the computer after the erase, but before writing the new firmware, you would have no firmware an could not boot. That is why during some updates the OS will warm you not to turn off your computer, and make sure you are connected to a power source. Sometimes a backup copy of the firmware can make this step a little less risky.
I'm just scratching the surface with generalities; This is a large topic.
Hope this helps a little.
