Looks like this was something that QEMU inherited when it took code from https://en.wikipedia.org/wiki/Slirp . Even after reading that page, I'm still not sure how it works; is it like a SOCKS proxy?
It creates what looks like a virtual NIC (literally in qemu's case, indirectly by SLIP in the original Slirp), and reassembles the packets it gets coming in from the guest OS or SLIP user. For example, a SYN packet gets turned into a call to connect(), and a data packet gets turned into a write() on the appropriate TCP socket FD. An RST packet gets turned into a call to close(). The reverse happens in the other direction, based on the read() data, fake TCP packets are generated, a closed socket gets mapped to a RST packet, and so forth.
From the outside, it looks like the guest (or SLIP user) is NATed through the host's IP address. But really it is just reassembling the intention of the guest based on the packets it is sending and calling host kernel functions to cause the same effects.
This was in the days when people had dial-in accounts to a shell, and wanted to use Mosaic web browser on their machines.