Everything is injected. Even most of Pokémon Gold, including the code enabling GBC features (the font is the same tho). This can't be done on the NES because the character (graphics) is in CPU-inaccessible memory (and therefore ROM on most cartridges). There are several stages of the payload that write and execute each other:

name+item manipulation
- a few bytes in several seconds
copying existing button input buffer
- 60 bytes per second
polling buttons in a loop
- only CPU-constrained, almost as fast as copying from the cartridge to RAM, literally fast enough to stream video at 10 fps (or in this case, 15 fps with ⅔ of the screen area updating, see technical writeup OP linked)

The Ocarina of Time "Triforce%" TAS speedrun (very good live commentary at GDQ!) activates some debug code such as the inventory debug menu and Starfox spaceship model

[–] akunohana@piefed.blahaj.zone 3 points 2 days ago* (last edited 2 days ago)

What have you done. I saw your comment the moment I entered my flat. I shouldn't have pressed the link (pun intended). But I did.

I didn't change, shower, eat or any other of my coming home on a workday routines. I just watched. And cried at the end.

My childhood is now complete. Thank you 🫶