The vulnerability is not specific to VMs. Malicious code running with privileges on the host operating system can also exploit it.

But yes, this can also be used to escape the VM sandbox, and since the TPM has full access to the entire system, exploit code can then gain full privileges on the host.

Can the TPM firmware not write to the flash where it's stored? If it can, then an RCE exploit can do so too, and thereby make itself persistent.

Basically, any successful RCE exploit in a TPM equals total and permanent compromise of the entire physical machine. That's why the TPM is a security threat rather than a security feature.