They probably just set user agent (and reverse DNS name) to Google or some other company that can bypass the firewall.

This seems the most likely way it works. Which makes me unsympathetic to publishers who complain about it. Digital distribution will always have this issue. Substack goes from strength to strength because they don't give an inch on the paywall.