To expand on that, those websites mostly operate on random volunteers self hosting a (starting price) fairly cheap receiver and antenna with an open source stack that feeds the ADS-B data to the website operator in exchange for nothing or free "premium" benefits.

The spoofer could have just sent them fake location information drawing an image using latitude, longitude and altitude for color (in the default view flight paths have different colors based on the altitude of the plane at that point in time).

They could have built an antenna and actually broadcast this data, but that would be a lot more effort and most likely some form of crime.

As a pilot I really hope it's the former. Broadcasting spoofed traffic at minimum would be confusing and distracting to both pilots and ATC.