How can a DC motor (toy) be run with only an Arduino and transistor without an external power source?
Your confusion lies in what can &quot;supply&quot; power.
Your assumptions are all correct for an IO pin. However the Arduino has more than just IO pins. It has power pins.
These power pins are not controlled in any way by the microcontroller - they are merely connections into the power supply circuit that also powers the microcontroller.
So in that circuit the Arduino's power supply is shared between the Arduino (the MCU) and the motor.
The 5V pin of the Arduino can supply up to 450mA (when powered from USB - 500mA less about 50mA for the MCU) or up to 800mA when supplied with about 6.5V into the barrel jack (any more than that will cause excess heat to be dissipated which will reduce the maximum current the 5V regulator can handle before shutting down).