What we normally see mod chips soldered to are debug points and test points -- when in the factory, going in for repairs or being developed you need to test your device and get data in and out, especially of the security system.
Said points if they are not removed from final builds (which may well be easier said than done for high speed devices sensitive to interference, or needing matched impedance traces) may then be used the hackers.
A soldered mod chip then most likely is a chip or two on a little board, maybe with a few passives to do what it needs to do, that the would be modder gets to throw leads from to the points on the board. From a device making perspective this is a standard PCB making exercise able to done cheaply and easily.
Said debug/test points often use something called a bed of nails tester,
which is much as it sounds. One way solderless then works is to have something similar come down from the chip and be mechanically coupled to it, which can be easier said than done. This is not as cheap as the normal board.
Option 2. While the test points might be removed the legs on the chip still do what they need to do. You then make a cover which goes over the chip (which is about as tricky as it sounds, and probably more expensive) to speak directly to the legs of it. There are also ways for chips without legs (see BGA) to have stuff done but unless it is outside balls I don't expect that to happen for a consumer device.
Option 3. if there is a connector, like the wii drive or 360 drive, or maybe just classic pins like a PC motherboard, you sit your device on that. Here you make your device go between that or replace that. Some have wondered if the little clip in board is what is being used here, and as it does contain the NAND with all the nice system data then it is also a viable attack vector. That connector might be an off the shelf one or it might not but likely still more than the basic fly some wires from a simple PCB.
There is no indication this will be a flash cart and if it happens right on boot that will be very surprising. It is not impossible that there is some check on the cart slot for a repair device that force boots from that but I expect TX would be shouting from rooftops that they have a flash cart of that scope coming out if so, even a clone cart a la the sky3ds (the gateway was the launched exploit one, sky's stuff was clone/duplicate a game) would be a shout it from the rooftops affair.
