The main chip of the RPi4 has a small amount of code in a built-in ROM which runs on boot. In the normal boot flow, that code loads the bootloader from the EEPROM chip, but it can also read a recovery image from the SD card. See https://www.raspberrypi.com/documentation/computers/raspberr... for details (or https://www.raspberrypi.com/documentation/computers/raspberr... for how it was on the older RPi devices).