They don't; we've disassembled hundreds and I can't remember a single one that didn't have a BMS in the pack itself. They're almost always passive top-balance with minimal actual balancing capabilities, but the protection is there. For reference, the smaller packs marketed as 18v and 20v are 5S...