How did Apple re-install everything in a clean Big Sur install, without access to backups?

Okay, Apple are really starting to freak me out (I don’t use them much). Here’s the timeline of my story:

My daughter’s MacBook Air (2017-ish) that she needs for school would not update to Big Sur because it had a pityingly small 128G SSD. So, I decided to spring for a 500G one and get her device to a more acceptable level.

I first tried this on my less important Mac Mini, swapping out the 500G for a 1T, though still spindle rather than SSD (I don’t need the speed on that box). A Time Machine full backup was done in preparation for restoring, the new drive was inserted, and I used recovery to get everything back. That worked well.

Daughter’s machine, not so well. Trying to do a normal recovery with command-R and restoring from Time Machine, resulted in a failure, the text which I don’t remember. But it did seem very fast compared to the following step.

Doing it with command-shift-R seemed to work but consistently ended up rebooting with a dreaded:

         

---

So, I thought, forget the automatic recovery, I’ll just install Big Sur and try to get the data from Time Machine afterwards (I’d read a migration would allow this). I left the install running and went to work.

The first thing I noticed was that it didn’t ask me for my wi-fi password, despite the fact it was a brand new SSD. I can only assume certain stuff is stored in the Mac somewhere, separate from the drive.

The thing that really amazed me was that, when I got home, the machine seemed to be fully done. It had my daughter’s account information, all her files that she knew about, all the apps she had installed, the screen-time settings, the school stuff like Office 365, and everything that I know to look for.

This is despite the fact neither the Time Machine backup nor original SSD were available during the Big Sur install. I know Mac aficionados say it "just works" but this is bordering on "horror movie" scary.

I guess what I’m trying to ask is:

1. How did this actually manage to do all this? Is there more stuff than just the wi-fi password stored on the device outside of the disk? This is about the only way I can see this happening, though it couldn’t possibly be a large amount of data, surely?

2. Can I be reasonably certain it did it properly? I want to avoid the drama of visiting IT support next year when she starts school, because I may have stuffed something up.