Like the image below, the Giphy integration is capable of posting a message on behalf of the user when receiving a /gihpy
command even though it does not require an OAuth flow.
How can this app possibly have the user write a message without the user's token? I've searched the whole documentation but couldn't find the solution.
You cannot do that without using the OAuth flow.
The apps like Giphy and Google Calendar are created by Slack's vendor partners, and hence they have features that normal custom apps does not have.
(e.g. Google calendar's modal UI is not available for normal custom apps)