Inside the 8M SPI there is:
- EDK2-based firmware (BIOS)
- GRUB legacy
- a Linux kernel and a tiny but functional Yocto system.
Arduino sketches run in user space.
The "bootloader" term is only kept not to confuse Arduino users - some haven't and will never hear about Linux.
Note GRUB is configured to boot (a bigger) Linux system from microSD (or USB) instead of SPI when a GRUB config file is found there in a predefined location.