As I understand it, the ZX81 video system, which resides in the ULA like all the rest of the machine-specific logic, works by using the CPU as an address generator: during active scan line, it lets the CPU try to fetch an opcode from video memory, grabs the opcode for itself to use as a character cell byte, feeds the CPU a NOP instead, then uses its own 3-bit counter plus the character cell byte to fetch a bitmap byte from ROM. An advantage of this system is that the ULA does not need to contain the 10-bit counter that would otherwise have been needed to address video memory.
Looking at the pinout of the ULA: https://www.sinclairzxworld.com/viewtopic.php?t=1249
It has D0-7, obviously needed, also A0-8, needed to generate 512 different ROM addresses, presumably corresponding to the 512-byte font for 64 different characters.
It also has A14-15. What does it use these for?