They are using connman (Connection Manager) and i think it might be communicating with wpa_supplicant and sending the configuration through socket /var/run/wpa_supplicant/wlan0.