Where and how do universal remote control companies get their IR codes?

They buy/license the database for the companies that make the IR transmitter ICs.