How, exactly, would you guess that they do that? What kind of technology would they use to operate fast enough, yet stay in sync with a target system?
I do not know, and neither do I care, but they do!

Certainly JTAG is utterly incapable of "real-time" anything, since a typical MCU can execute several instructions within one bit-time on the JTAG cable
who gives a ...., the JTAG is only active when the uC is stopped.

Have you ever looked inside an ICE ... a "real" one, with a bondout chip? Have you ever looked at the datasheet for a bondout chip, e.g. the one from Winbond? How do you suppose they do anything at all in real time (meaning at the rate at which the target operates) when emulating on a "real" core?
I do not know, and neither do I care, but they do!

Erik