The programmable pins (General Purpose Input/Output) can be used in a variety of ways - but not all at the same time. Before the point where power is applied to the RPi's Systen-on-Chip (Soc) AND it has performed a reset the state of those pins is entirely dependent on the design of the circuity inside the SoC - it is likely (I haven't checked the information {that is available}) that most I/O pins adopt a high-impedance input state as that is the most likely to be "safe" until things can be configured. In that situation external pull-up or pull-down resistors will establish a level that anything else connected to the pins will "see".
During the reset process a SoC will then set each GPIO to a "reset" state that will also be defined somewhere, in the RPi's case, Broadcomm's "datasheets" for the Soc before moving into the "booting" phase which, for the Raspberry Pi has a late stage that involves reading the config.txt
and that is the first point where some pins state/function can be configured by the user, this is where the device_tree is initially determined by the VPU and some pins configured to allow the rest of the system to boot-up.
I suspect, but haven't yet found out how, that the "device-tree" will ultimately offer the ability to configure GPIO pins in the manner that the user wants as soon as possible after the RPi is powered up. For example, this Foundation's Forum post shows how one or two pins were "reprogrammed" to work with an external power control system (or rather a control chip as part of a power supply regulation module) and how the default configuration was tweaked to work with the different conditions that were wanted for it.
Once the OS is fully up and running then the GPIO pins can be reconfigured via the "normal" means that software libraries for the task, such as pigpio
provide.
Over on Stack Overflow someone seems to be asking about the GPIO pins and the device_tree on an RPi the links in the answer there could be of assistance I think if you want to investigate this further.
EDIT: As to whether it is normal to have odd behaviour like this during the start-up process I have to say it is not an uncommon 'gotcha' when using microprocessor/microcontrollers. The question "what is the power on state of the GPIOs?" has a link to a forum post "Power on behaviour" which was discussing a problem back in the early history of the RPi when the all the GPIO pins were apparently set to be outputs for a short time! That was, fortunately, revised, but it does highlight the need to check before committing a hardware design to production and also to consider transient behaviour under abnormal conditions such as power up/down or if the end user does something unexpected like pressing all the buttons down when they are only supposed to press one!
I am still working on a system that will use an RPi to unlock my house's front door - and in consideration of this sort of issues I am using not one but two GPIO pins and both of them have to go to the opposite state from that which they have during start-up simply to avoid the issue of a power glitch leaving my house unlocked when not expected {and I'm using a RPi UPS system that will keep the RPi running for several days even if the Mains power does go off...!}