This seems the most likely way it works. Which makes me unsympathetic to publishers who complain about it. Digital distribution will always have this issue. Substack goes from strength to strength because they don't give an inch on the paywall.

Maybe they also use Google Cloud to look more convincing.