What URIs are accessed by drush up? Is it drupal.org? Are there any other URIs? I have tried using drush up --debug, but I can't seem to find a list of URIs. I have also googled it using the key words drush access URL and drush access URI, among others.
I just took a look through the drush code. In Drush/UpdateService/ReleaseInfo.php, you can see that drush grabs project release info via this url: https://updates.drupal.org/release-history
You can test it yourself - try https://updates.drupal.org/release-history/views/7.x for example.
The release info contains the download links for the projects.
Drush actually has two package handlers, git and wget (see commands/pm/download.pm.inc)
The wget one uses the download_link from the release history, and the git method uses git.drupal.org. See commands/pm/package_handler/wget.inc and commands/pm/package_handler/git_drupalorg.inc
If you are referring to
drush dl, then by default Drush downloads from drupal.org, if you don't tell Drush to use another URL.
For example, if you use
drush dl views --source="updates.modules.org/history", Drush would probably download the Views module from modules.org, instead of drupal.org. From where the module would be downloaded depends from what updates.modules.org/history/views/7.x (for Drupal 7) or updates.modules.org/history/views/8.x (for Drupal 8) returns.
If you look at what https://updates.drupal.org/release-history/views/7.x retuns, you will notice a line like
<download_link>https://ftp.drupal.org/files/projects/views-7.x-3.14.tar.gz</download_link>, which is telling to Drush to download the Views module version 7.x-3.14 from https://ftp.drupal.org/files/projects/views-7.x-3.14.tar.gz.