A master device initiates the transaction. It controls everything, reads and writes, hence the word 'master'.
A slave device never initiates the transaction. It responds only to master, either to return read data or to complete a write. In some cases, no read data is returned, and the device only accepts writes. And, there are a few devices that only return read data and ignore writes.
The terms "microcontroller in/sensor out" are not an accurate description. The closest ones are something along the lines of "initiator out/target in" or "controller out/responder in". But these are clunky,
master/slave perfectly describes the arrangement, and it isn't intended to be offensive.
When it comes to an SPI flash, no, the 'slave' flash device is not a master no matter the data it stores. Does the flash ever boot the MCU? No. The MCU reads the flash in order to execute code or do something with that code. If the flash memory had a 'brain' and could actually start controlling the bus, you might have a point. But, it does not.
Do we have documentation of someone who is actually black who finds the terms offensive? Rather than some pasty-white college students who have written a paper about how black people should find something offensive, because it seems most SJWs just want to role-play for minorities sometimes.