They use an authenticated data storage slot. All of the ones using ATECC series do this. It has data storage slots & a few ECC key slots. Of course it’s P-256 only (not secp256k1) and only supports signing, so you get this. Same thing with Infineon Optiga based ones which can’t do the required algorithms for Bitcoin but can at least keep more types of keys on SE.