Registrars interface with registries using a protocol called EPP (see RFC 5731 for the bit relevant to domains), generally speaking. They perform updates to dom

Registrars interface with registries using a protocol called EPP (see RFC 5731 for the bit relevant to domains), generally speaking. They perform updates to domains by sending a domain:update request to the registry's EPP endpoint. There are some complications depending on whether registries treat nameservers are attributes of a domain or independent objects, but that's the gist of it. Behind the scenes, the registry will update their nameservers to reflect the updated nameserver list for the domain. Registries don't pull from registrars.