I don't know about Vertex or Motorola radios how the frequency range is verified, but with Kenwood I do. Maybe Vertex or Motorola radios are similar.
The radio programming software reads the code plug which has the radio's model number and sub type embedded in it. When the software tries to write the code plug to the radio it first queries the radio for model and sub-type. If the two don't match the software generates an error message. One version of the software with the license key I used for installation even offered to let me change the "market code" changing a radio from a European or Asian model to a US type! The service manual claimed if you used the wrong model type, and the associated market code, to program the radio "the first time" it can't be changed later. Apparently that's not true if you have the right software.
Some of the Kenwood radios use "XOR" encryption on the code plug contents I discovered, for example the popular TK-3170 and TK-3173 radios. After some lucky guesses and looking I found where in the code plug the encryption key is stored. It seems to be located in the same place even between totally different radio models. I suspect the software programmers used the same code plug file structure for the beginning section across model types. The key however can vary from code plug to code plug even for the same model type.
After decrypting the code plug the version of the radio software, radio model type and the installation license key, used to install the software which created the code plug, was found. The frequency was stored in little Endian integer BCD format. For example 462.67500 MHz was stored as 00 75 26 46, two BCD digits packed into each byte.
Any passwords set in the radio, such as power up enable, radio read or radio over write are also stored in the code plug. Without the engineer's license key for example even if you loaded the code plug in to the programming software the radio over write password is blanked out with asterisks. If you know where to look in the decrypted code plug even that password is in the clear and can be recovered allowing a radio to be reprogrammed. The software will prompt the user for the password if one is used and will refuse to either read the radio or over write the current code plug depending on which passwords are set.
The channel names, group names, strings in general, are stored in normal ASCII format.
Other options and features are likely stored as bit fields or some other type packed data structure. Since none of this will ever be documented by the manufacture so a good deal of experimenting has to be done to reverse engineer the code plug further.