The user may additionally use any available GPIO for the SPI flash IO2 and IO3
    lines;  the pass-through mode only uses the basic 4-pin SPI mode.

Assuming we are building boards with SPI flash on them, does it make sense to specify IO2/IO3 so they can be routed to the SPI flash?

That statement is probably misleading and I should have given it additional context. From the perspective of the verilog RTL, any available pins would do for IO2 and IO3. In practice, though, there will be a footprint for a 2nd SPI flash on the development board, and that should have IO2 and IO3 connected to the next two pads (GPIO 12 and 13).