It is somewhat incorrect to say DOS' commands are embedded in command.com. There are MS-DOS commands which are implemented in the command.com, but then again there are commands that are built-in to shells like bash. Ever seen an executable for cd, logout, history, or bg? Heck bash even does kill. One way to think about it is, command.com is the shell and io.sys is the MS-DOS kernel.

After your computer boots, it kicks up the hard drives, reads the boot sector, the boot sector loads and executes io.sys, and io.sys loads config.sys to see if you have changed your COMSPEC. If the COMSPEC is nil, it is defaulted to c:\command.com. Io.sys then kicks up your shell (usually command.com).

Interestingly enough, command.com hasn't actually been a com file since back in the early days of DOS. You can tell (the same way the DOS kernel does actually) by looking at the MZ signature at the beginning of command.com. Command.com is actually an exe file.