Updating multiple Espruino devices

the onboard software, as long as it has a BLE connection to any phone, would be able to connect and pull the latest code, even if that meant some remote security feature.

The issue is that the bluetooth spec doesn't provide any provision for internet access over Bluetooth LE. So any communications with the internet have to be via some special software on the phone.

would it be possible to use something like Firebase via NPM package to establish real-time connection via the Javascript interface?

If you run that on the phone, then yes absolutely. But as above, you can't do internet directly via BLE so it can't all be on the MDBT42Q.

You can use 'Web Bluetooth' on the phone though (which is just a website) so there's no need for an app - and that could trivially use firebase/etc to fire commands off