The check in question is likely happening on the T2 itself; it's a small ARM processor (derived from the ones used in iOS devices) running its own OS (a variant

The check in question is likely happening on the T2 itself; it's a small ARM processor (derived from the ones used in iOS devices) running its own OS (a variant of watchOS, which is itself ultimately a derivative of macOS). Among other things, it's responsible for the early boot process; it performs firmware and OS verification and can stop the boot process if it thinks things don't look right.