It’s an expensive operation, so rather than it happening automatically you have to run it somewhere when you know your rewrites have changed. There are also circumstances where WP may not know it needs to flush the rules: Deletion of a plugin that registers a CPT for example.
In your own plugin, run it on the activation and deactivation hooks.
If you use flush_rewrite_rules( false ) then your .htaccess won’t be resaved.