I don't think there's much risk of data corruption at reflow temperatures for a short cycle, although maybe it takes a small fraction off the usable retention lifetime.
Most of the major microcontroller vendors will sell you devices pre-programmed with your firmware - so it stands to reason they expect you to solder them. I'm talking about pre-programmed into flash, not mask ROM, and it can be done in modest quantities.
It's also common reverse-engineering practice to desolder a flash IC from a PCB to read it out.
There are certain more exotic nonvolatile memory types to which this definitely does not apply - data stored in phase-change RAM will not survive reflow, and IIRC older MRAMs were also susceptible though nowadays MRAM manufacturers are saying it's not a problem.