Which remote does git submodule update use when fetching missing commits?

Note: The question is about using git submodule update without the --remote flag.

The documentation for git submodule update says the following:

Update the registered submodules to match what the superproject expects by cloning missing submodules, fetching missing commits in submodules and updating the working tree of the submodules.

What I don’t understand is how Git decides which remote to use for fetching in a submodule. Does Git take the URL for the submodule from .gitmodules/.git/config of the supermodule and then fetch missing commits from that URL?

I am confused because documentation states that this URL is only used when a submodule is missing, that is, for its cloning:

submodule.<name>.url

Defines a URL from which the submodule repository can be cloned. This may be either an absolute URL ready to be passed to git-clone[1] or (if it begins with ./ or ../) a location relative to the superproject’s origin repository.

Does it perhaps use a standard rule for git fetch in a submodule?

When no remote is specified, by default the origin remote will be used, unless there’s an upstream branch configured for the current branch.

Thus, if I am currently checked-out in a submodule on a branch that does not have an upstream branch, git submodule update command uses the submodule's origin remote. However, if I am currently checked-out in a submodule on a branch random-main that follows (has upstream) remote-tracking branch random/main, then git submodule update command uses the submodule's random remote for fetching.