They don't. Especially not if you are thinking along the lines of the NES mappers, SNES special chips or GB/GBC MBCs.
Their job is to sit on the pins of the DS and respond as an original cart would for the game itself
http://problemkaputt.de/gbatek.htm#dscartridgeprotocol
and the save files
http://problemkaputt.de/gbatek.htm#dscartridgebackup
The pokemon games with a pokewalker might be of interest here.
The menu they provide is just a custom ROM that will have some form of read the flash cart's internal logic/processor will know how to decode as "present this ROM", at which point the flash cart starts presenting that rather than its menu ROM and resets to run the game. Any encryption is also handled as well as part of it, said encryption being beaten a fair while into the DS lifetime (before that people were using GBA slot stuff and fairly extensive patches).
Savestates, soft reset, cheats, readers and the like are hacks at game level to provide it, as are most anti piracy patches (some later flash carts mimicked a certain type of read more accurately that devs were using to detect flash carts). This is easier than some older systems as hooking DS games is not the hardest thing. The in game menus some had being a slightly more advanced version but still just sitting on the pins and presenting data, just data swapped out and generated on the fly according to requirements.
Somewhere around here I have a copy of the AKRPG source you might find of interest if you are delving into this, though it was more the loader than the core of the flash cart.
Some flash carts like the iplayer, ISMM and DStwo (so called enhanced flash carts) have their own onboard processors that can be used to run emulators (the latter two even getting to the point where the PS1 was sort of maybe playable for a turn based puzzle game or something) and that can get fun to handle (most didn't use both at the same time to do anything real as it was a nightmare, instead the DS processor was mainly used as a pipe to get controller data to the flash cart). A bit lower down the scale other flash carts turned their internal processors to handle the checksums done as part write verification when homebrew (see DLDI and libfat) was writing to the flash cart.
