Not so much for code, but lots of use for persistent data (logs, databases, etc.). Only a part of it would be used for XIP. Also with more flash space it's easy to have multiple banks for safe firmware update and the like.
NOR is more durable than NAND (but smaller, more expensive per bit), but yes you have to be careful with logs. In most recent case, it was in the 10s of small records per day.
The libraries you pull in can be big. Add, e.g., LWIP for internet, USB filesystem management (data logging and USB firmware update), code to properly manage OTA or Ethernet updates, text strings, especially in multiple languages, etc.
What seems like a huge amount of Flash disappears quickly.