It’s from bacteria, and rather than accumulating the toxins from diet – the way for instance ciguatera poisoning, which is from algae, works – it looks the fish can acquire the bacteria and keep them symbiotically. But the details seems to be surprisingly poorly known.
In particular reports of tetrodotoxin in different species have a lot of false positives. It’s been claimed from a dozen or more types of bacteria, but only one or two are well-established. I’ve seen books list it not just in different true puffers but in related porcupinefish and even molas, but most others seem to find no evidence of that. So it’s hard to say exactly how widespread it is.
Most things do seem to agree that northern puffers aren’t really without toxins, though, it just isn’t in the flesh so is easy enough to avoid.
Edited to add:
Part of how people know the toxin isn’t produced by the fish themselves is that they were able to take eggs from a poisonous puffer and raise non-poisonous fish in the lab. So it could definitely be done with any kind, if that’s what people wanted. However, I’ve also heard the traces of tetrotoxin are part of the appeal – in very small amounts they make your lips and fingers tingle.
