I think the real question is why bother doing it with this website? The controller has a USB port on it and I imagine can talk over USB. It would be far better to just have some application which can flash over USB instead of needing some Google-hosted website. Just give me an executable that people can toss on a torrent or whatever. I appreciate they did something to make these controllers useful to people, but it seems like they really didn't pick the best path to achieve that.
I imagine they probably painted themselves into a corner and the firmware update process is so locked down and will only talk to approved Google endpoints over an HTTPS request or something like that and that's the ultimate reason why they went that route. But really I feel that kind of shows a failure to imagine the hardware life after the service.