Great question - i don’t actually know for sure. I assume that it’s a hardware default of the SoC, since i’ve seen different addresses used for many atheros, broadcom, and mediatek devices. Since the bootloader needs to get loaded from that address, it has to be set - or have a default value - before that point.
My best guess is the spi controller IP block they’re using has it as a tunable parameter, and at silicon design time they could choose to use the default, hard code it to something different, or set up a configuration register that allows the value to be changed if necessary. My guess is the third option, but that capabilitiy exists only for debug purposes – like if their silicon wasnt booting they could go in and use jtag to change the SPI flash address for test purposes. This is just speculation, though.
Once the kernel is booting, it’s no longer using the memory-mapped access to the SPI flash, and instead communicating with the spi controller through a driver, allowing access to higher speeds and other spi features.