The Arduino CLI uses a slightly different version of bossa from the one that is on master:
https://github.com/shumatech/BOSSA/tree/arduino
On Linux, I was able to do the following:
$ git clone [email protected]:shumatech/BOSSA.git
$ cd BOSSA
$ make bin/bossac -j4
$ stty -F /dev/ttyACM0 1200
$ ./bin/bossac --port=/dev/ttyACM0 --force_usb_port=true -e -w -v -b /path/to/my/firmware.bin -R
(I got the answer from this Arduino forum thread.)