The DEVICE directive has historically instructed mdadm which specific block devices (/dev/sda1, /dev/sdb1, etc.) need to be scanned for RAID superblocks.
However, in modern Linux distributions (especially with udev and systemd), explicitly listing devices is most often no longer required because mdadm can scan devices on its own.
If the DEVICE directive is missing, mdadm will by default attempt to scan all available block devices in the system (excluding, for instance, CD/DVD and so on).
Together with the fact that each ARRAY line is strictly tied to the RAID array’s UUID, mdadm knows exactly which devices are part of the array (by reading the RAID superblocks from each discovered disk).
This is especially relevant in conjunction with udev, which itself «provides» mdadm with the necessary events when disks appear or disappear.