Everything is injected. Even most of Pokémon Gold, including the code enabling GBC features (the font is the same tho). This can't be done on the NES because the character (graphics) is in CPU-inaccessible memory (and therefore ROM on most cartridges). There are several stages of the payload that write and execute each other:

1. name+item manipulation
   • a few bytes in several seconds
2. copying existing button input buffer
   • 60 bytes per second
3. polling buttons in a loop
   • only CPU-constrained, almost as fast as copying from the cartridge to RAM, literally fast enough to stream video at 10 fps (or in this case, 15 fps with ⅔ of the screen area updating, see technical writeup OP linked)

The Ocarina of Time "Triforce%" TAS speedrun (very good live commentary at GDQ!) activates some debug code such as the inventory debug menu and Starfox spaceship model