I don't know the details, if i new em apple would also and then they would block it.
But the phone is the one that checks if your sim is blocked, the baseband is its own computer (soc, system on a chip). Its as i said done locally and thats why a "simple" "turbo sim" works.
What it does is intercept the way the sim identifies it, and since its a pain in the ass and doesn't work more than 1/5 of the time, i suspect it uses a buffer overflow (google it) to insert code (im not sure).