I had a look at the available documentation ("How to program flash memory...pdf") and it appears, that all accesses to data flash (read/write/erase) shall go through IAP. This is uncomfortable, impractical, whatever; nevertheless it is in fact documented quite concisely.

---
[speculation mode on]
I'd bet the IAP internally does INDEED use MOVX for these things; I would not be surprised if it would use some SFR bit to toggle between RAM and data FLASH for MOVX. Often, in chips with FLASH, during such remapping, code fetch from FLASH is impossible, so such code must then run from ROM - that might be the reason why data flash access happens only through IAP.

Note also, that there is a SFR bit (PWE=PCON.4) documented for code memory (flash?) writing(!), and those parts sound rather confusing, too. It appears, that code flash is written using MOVX (which is not surprising), but the timing diagrams around the waitstates description appear to indicate, that such write occurs immediately, so probably code memory can be mapped also into RAM somehow (?)

Clearly the documentation does not tell EVERYTHING of the chip - but then, isn't this the sad norm with most of the modern '51 derivatives?
[speculation mode off]
---

Of course there is also the language barrier - but please keep in mind, that it goes both way. They might have misunderstood the question, and you might have misunderstood the answer (or even both... ;-) )

JW