I have the same question when I tried to airdrop the simulator from one Mac to another (don't want to download it again)
$ xcrun simctl runtime list
== Disk Images ==
-- iOS --
iOS 17.4 (21E213) - 72E27A4C-7B41-448C-B18A-0A1F7EC9590C (Ready)
Total Disk Images: 1 (6.7G)
I found the directory where the simulator runtime stores:
/Library/Developer/CoreSimulator/Volumes
I opened it in Finder but I can't airdrop that folder as it's a mount point
$ mount
/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk3s6 on /System/Volumes/VM (apfs, local, noexec, journaled, noatime, nobrowse)
/dev/disk3s2 on /System/Volumes/Preboot (apfs, local, journaled, nobrowse)
/dev/disk3s4 on /System/Volumes/Update (apfs, local, journaled, nobrowse)
/dev/disk1s2 on /System/Volumes/xarts (apfs, local, noexec, journaled, noatime, nobrowse)
/dev/disk1s1 on /System/Volumes/iSCPreboot (apfs, local, journaled, nobrowse)
/dev/disk1s3 on /System/Volumes/Hardware (apfs, local, journaled, nobrowse)
/dev/disk3s5 on /System/Volumes/Data (apfs, local, journaled, nobrowse, protect, root data)
map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)
/dev/disk9s1 on /Library/Developer/CoreSimulator/Volumes/iOS_21E213 (apfs, local, nodev, nosuid, read-only, journaled, noowners, noatime, nobrowse)
I guess the block device "/dev/disk9s1" is the result of "cloned, staged, verified" by the command xcrun simctl runtime add and then it was mounted at
/Library/Developer/CoreSimulator/Volumes/iOS_21E213