Generally, they have special computers that basically self-destruct when tampered with, that handle transferring key material. It's in the Apple design docs if you read them.
Apple really tries to get this right. Some countries(like China) require the computers to physically live in the country, so there could be special implementation details that alleviate some of those security guarantees, but we don't really know.
Of course, if you live in China and rely on any vendor that operates in China to protect you from the Chinese govt, you probably are wrong.