Other parts of the documentation state that the VCCPGM line can be at 1.8, 2.5 or 3.0V so I don't see any reason why you couldn't use 2.5V for your pull-ups. It looks like all the configuration schemes that use an EPCS flash in that documentation mention this 3.0V voltage level, probably because the flash doesn't support a 2.5V supply and Altera is afraid of overshoots with a 3.3V supply. On page 318 (9-34) it could just be a bad copy/paste.
DEV_OE is an optional function, and will be used only if you enable it in the device options window. By default it is disabled and you can use this pin as a regular I/O.