How does Firefox update itself without asking for root/sudo password?

The reason you do not need to enter sudo passwords for upgrades in modern systems is because these processes currently are managed through Polkit (formerly called PolicyKit). This is a mechanism that checks if a request, i.e. for updating, is authorized or not. That is defined through polkit rules.

Firefox is by default installed through the APT package management system. In Ubuntu 21.10, Firefox is installed as a Snap package. For most of the updates, the policy is configured such that these can be checked for and carried out while a user with root access is logged in, without an extra need to provide the sudo password. For kernel updates, the policy is set up to still require specifically entering the sudo password.