Where does the security application execute in each implementation?

Short answer

At a high level, card implementations historically executed security functions on card secure hardware; SIM, eSIM and iSIM implementations execute within their respective protected SIM environments as integrated by the platform. Exact execution boundaries, host APIs and operator roles differ and are marked editorial_task in the hardware matrix until confirmed.