You need to get a hold of the firmware image, erase the flash and apply the new firmware.
Bad idea since flash also contains serial number, model/hardware revision, MAC address and may contain WIFI modem calibration data.
Of course you would not erase the entire chip. Doing so on most consumer devices is tricky, even if you get access to the bootloader. We often go into a significant amount of effort to prevent end users from bricking their devices. Even the "factory mode" is often a one shot affair, where we erase the software that the factory uses during the manufacturing process as the device reaches the end of that process. Once that is done, the only way to alter the factory information/flash partitions is using an in-circuit flash programmer or similar "drastic" measures.
What I was talking about is the fact that in order to reprogram those flash partitions that contain the firmware image, each block of flash will typically be erased, tested, remapped if the erase fails, programmed, tested, remapped if the programming failed. Thus, reflashing firmware on a router will typically not only "re-install" the software, but also go through an erase and verification cycle to ensure that the new image is stored in good blocks.