The simplistic answer is that the packages in Ubuntu are always built on Ubuntu auto-builders from source packages in the archive. Debian until recently allowed binary packages built by individual maintainers to enter testing and ultimately stable, that is no longer allowed since testing migration reopened for the bullseye cycle, but Debian developers are still permitted and in some cases required to upload binary packages to unstable. Ubuntu is much stricter on the introduction of external binaries.
However the simplistic answer leaves a few gaps open.
Firstly there is no technical measure to guarantee that the materials used from a source-package are actually source code. Indeed there can't be because the understanding of the term "source code" in the Debian community is more akin to the GPL definition than the traditional definition and hence depends more on how a file is created and maintained than what format it is in.
Secondly the content of a Debian binary package depends not just on the source package, but on the environment it is built in. That environment is formed by installing binary packages.
Which brings us on to the issue that some programs require themselves to build. gcc, glibc, binutils, make etc require gcc, glibc, binutils, make etc. rust requires rust. freepascal requires freepascal. golang is normally built with golang (it claims to also be build-able with gccgo but when I've tried, it didn't actually work).
Most of the time this is dealt with by using the previous version to build the next, but sometimes things go wrong and it becomes impossible to build one of these packages in the normal way because the existing version of the package is too broken on one or more architectures.
Sometimes maintainers will work around this by including bootstrapping binaries as part of the source package. Other times the packages in the archive will be re-bootstrapped with manually built binary packages. In debian this is normally done by the developer simply uploading the binary packages to the archive, then following up with a source upload to force a rebuild on the autobuilders. In Ubuntu I'm not sure exactly what the procedure is but I do know that only a relatively small number of people have permission to do it.