I've seen some theories or maybe more like guesses as to how the paywall bypass works - I don't think anyone (or at least no one posting places like here) seems to know.

One I saw suggested they've a set of subscriptions to the paywalled sites and some minimal custom work to hide the signed in account used - which seems plausible. That makes the defense most likely used to catch the account used and ban them - which would be a right pain.

They probably just set user agent (and reverse DNS name) to Google or some other company that can bypass the firewall.