That is the same conclusion I reached after a lot of digging around and testing - then some more testing and hexEditing diskimage files.
grub in BIOS/MBR scenarios has always been installed to the the disk MBR - so there is no doubt how this is done.
The problem comes with BIOS/GPT where early implementations needed grub to target the partition - not the device.
grub has clearly some internal logic which searches the disk for a bios-grub partition and dump the core.img to that partition - but as both @philm’s and my tests showed that even if you leave out the bios-grub partition - grub will dump the boot.img to the protected mbr - then scan the device for the /boot/grub/i386/core.img and continue the loading from there.