@willy, IIRC the SPI peripheral is protected from non-secure world, meaning it may not be exposed to the OS as-is. The proper way to update would be to use UEFI capsules; not sure if they are implemented yet.
It would be good for this sort of findings to be added to the official docs. I often find myself looking up older posts here and pointing users to them.