APNs, the Apple Push Notification service, is the infrastructure every push to an Apple device travels through. Apps use it for notifications; Apple Wallet uses it for something quieter: telling a device that a pass it holds has changed and should be fetched again.
The wallet pass push is deliberately empty. It carries no text and no payload, because it is a doorbell, not a letter: the notification's topic names the pass type, the device wakes, asks the pass's web service which of its passes changed, and downloads fresh copies. The content of the update, new points balance, new tier, new offer, comes from that download, not from the push itself. This is why a push update can change anything on the pass at any time.
For a push to have somewhere to go, the device must have checked in first. When a member adds a pass, their iPhone registers with the pass's web service and leaves a push token, covered under device registration; that token is the address APNs delivers to. Sending requires credentials tied to the pass type, so only the platform that issues a pass can push updates to it.
What the member sees is controlled separately: an updated field with a change message puts a lock screen message in front of them, while updates without one land silently. On the Google side the equivalent plumbing is simpler, the platform writes to the pass object through Google's API and Google handles delivery, which is one reason a wallet platform's job is to make the two behave as one channel.