How do universal IR remote "codes" work?

The codes are just a reference to a set of actual IR codes. It tells the microcontroller or CPU (loose term) of the remote which type of code modulation, brand and device type to use. The standard protocols are RC5 and NEC, though there are other types. Once you know the protocol, the rest is just crafting the actual button code, which is a fairly small set of generic codes, typically 8 bits so 0 to 255 or 0x00 to 0xFF, and a manufacturer code. Each value does different things based on the device, so one tv may take 0x0A to mean power on, another might use that for channel down.

Universal remotes work basically by the manufacturer gathering as much data about common IR code sets for common devices and providing the end user with a way to set that code set. The codes you put in are just like a street address, with the remote figuring out all the information it needs for that code.

TV manufacturers sometimes reuse codes from one tv to another, and some white label manufacturers reuse them (white label manufacturers make generic TVs with a store name brand). So there's a lot of overlap in codes. No one likes to reinvent the wheel.

All the code does is tell the transmitting device what it's talking to. The specific commands would already be known by the transmitting device for each model.

As for how the remote knows the commands for each model, it would have to be programmed into the remote, so they would be defined and released by the manufacturer or reverse engineered.