Yeah, this one can easily be missed but if you take a look at the last line of the menuTemplate. The spDropdownTreeTemplate is called by a directive of a similar name spDropdownTree or (<sp-dropdown-tree>). Inside the directive you see that it returns the spDropdownTreeTemplate.

You can get to it by navigating to a rendered Service Portal page. Then right click and do an Inspect Element. Click on the "Sources" tab in the Dev Tools (I'm using Chrome). In the left side menu click on the "script" folder arrow to expand. Click on the js_includes_sp file. In the center pane do a search for spDropdownTree.js

In there you will see the template being called.

Here's a shortcut: https://<your_instance_name>.service-now.com/scripts/js_includes_sp.jsx to get to the file to search

Here's a screenshot:

You might be able to do away with the <sp-dropdown-tree> directive and use an ng-include="name of your template" the same way menuTemplate is doing.

Or you could make your own directive as well.