You short pins on the right joycon connection at boot time to enter recovery control mode in the boot firmware which (via an unpatchable exploit) gives you full access to the hardware IIRC.

(I presume the picofly & similar devices are just doing this automatically so you can boot the hardware under user control without requiring other hardware to make the exploit work?)

Unpatched v1 models can be softmodded no hardware modding (picofly) needed. For those you only need to enter the recovery mode which can be done with a paperclip > sorting the pins on the right joycon rail. Though it's also not recommended because you can fry the whole Switch with the paperclip. Nowadays people use 3D printed cheap RCM jigs.

First models of the switch can be jailbroken by connecting pins accessible without disassembly (used to connect joycons), lookup switch jig RCM.