I’m pretty sure if you asked the standards people, or a building insurance company, or a court, they’d say flashing does invalidate certification.
So that might be the hard line rule. But in practical terms and by way of example, I bought a couple of Shelly 2.5 to evaluate them for a new house build (along with many other devices), and the Shelly 2.5s get very hot, see my detailed post on this. The 2.5 has an internal temperature sensor, and will turn off the load if it gets too hot (at just over 90°C from memory). Shelly provide a header to allow reflashing of the ESP8266, but if you do that, say with ESPHome, and don’t implement the over-temperature safety feature in your own code, then you’ve removed a safety feature that might be part of certification. Even if it didn’t invalidate the certification, I’d be hesitant flash it unless I trusted my code to be as good as Shelly’s. If the 2.5 gets Aus certification, which it probably will soon, I’d still be very hesitant to install in the walls of my house!
Probably deviated from the original question there, but just a word of caution about reflashing devices and to consider how you might be compromising any built in / under the hood safety features of OEM firmware.