There are no references to VBOs here. It’s implied that VBOs are used, because otherwise you’re passing null pointers to glVertexPointer() and glColorPointer() (in C++, you should use “(GLvoid *)0” rather than just “0”).
VBOs are likely to be stored in video memory. That’s the whole point of VBOs. And to clarify, a VBO (vertex buffer object) is a buffer object bound to GL_ARRAY_BUFFER. If a buffer is bound to that target prior to calling glVertexPointer() etc, then the vertex data will be sourced from the buffer. If no buffer is bound, the data will be sourced from system memory. But in the above code, if no buffer is bound then the data would be sourced from address zero, which will likely trigger an exception.
Shader programs have to be stored in video memory in order for the GPU to execute them.
VBOs and shaders aren’t mutually exclusive. Prior to 3.1 and in 3.2+ compatibility profile, you can use VBOs with or without shaders, shaders with or without VBOs. In 3.1 and in 3.2+ core profile, both VBOs and shaders are required: client-side vertex arrays aren’t supported, nor is the fixed-function pipeline.