First of all, thanks all - glad a little trick I came across in 2022 still works and helps people out!

Hi Lori - I don't work at ServiceNow, so my educated guess is as good as yours.
My guess is they actually live within the instance, just locked down to some table we can't see. Maybe a role like maint (which we can't get) could see it directly.
They are loaded as XML (likely encrypted in transit) as part of the plugin or app install, and exist from a source instance.

If you needed to recover one, the safest way would be to repair the related plugin, or re-install the related application.

Assuming you get your hands on the original script (through a hidden method on this community post), you might be able to re-import it via update set XML, but you may risk corruption of that record altogether. Might be best to try on a PDI first which you can wipe and re-load if it doesn't work out.