It’s like a more curated AUR. Winget looks up the manifest (PKGBUILD equivalent) from its repo and executes its instructions. It usually downloads an installer, then executes it silently. The binaries may or may not be validated by Winget, and are mostly blobs, so exercise as much caution as with the AUR.