alt Hacker NewsYou short pins on the right joycon connection at boot time to enter recovery control mode in the boot firmware which (via an unpatchable exploit) gives you full access to the hardware IIRC.
(I presume the picofly & similar devices are just doing this automatically so you can boot the hardware under user control without requiring other hardware to make the exploit work?)
There's a site you can put your serial number into and it'll tell you if you're vulnerable