This appears to be true. If you look at Page 5 of [1], there's a side note about DFU mode. There's no indication that updating the firmware wipes the secure contents of the device, which it would need to in order to be secure:
"""
Entering Device Firmware Upgrade (DFU) mode
Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long.
"""
But we agree that the Secure Enclave code CAN be updated, correct? I know that it can, because I remember an iOS update that fixed a problem with Touch ID on my iPhone 5s. If the DFU mode can't do it, then you just need to load an OS that will do it.
The only question is, does the existing firmware blank the store keys before flashing the new update. I didn't see any indication that it does.
It seems like it can be updated but it's not clear whether there are any restrictions on that process. It might accept any signed update but that wouldn't be enough if it required Touch ID or the phone to be unlocked to avoid clearing the HSM.
""" Entering Device Firmware Upgrade (DFU) mode
Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long. """
[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf