It uses the Android virtualization framework: https://source.android.com/docs/core/virtualization

Using a modified KVM: https://source.android.com/docs/core/virtualization/architecture

The VM isn’t running in user space, it runs through the hypervisor, shell in userspace is just a convenience feature of accessing the VM that is running parallel to Android and the hypervisor enables passthrough of certain SoC features to talk directly to CPU/GPU, without traversing the android userspace.

It’s like running wsl on windows, both windows and wsl are virtualized and talking to hypervisor, your wsl instance isn’t running within your windows instance.

Difference is a fully virtualized Linux VM running natively, compared to termux terminal emulator running in user space with an independent package manager.
So you (in theory) have more hw access, access controls and aren’t limited to Android user space running a single user emulation - with no privilege separation existing within termux.