On the client side how did they do this? I worked with a team reverse engineering another MMO a few years ago and it was because of a plain XML config and game launch args that we could make the client connect to a private server easily without modifications. Blizzard could just implement DRM and put an end to all this, right?

WoW (classic era through MoP) stores all game assets in MPQ archives. The client has a built-in override system it loads patch files in order (patch-1.mpq, patch-2.mpq, ... patch-A.mpq, patch-B.mpq etc...) and later patches override earlier ones. So to add custom content, you just drop a new patch-X.mpq into the Data/ folder with your modified files and the client picks them up automatically.

For something like Turtle WoW's custom races and zones that means shipping modified DBC files (the client-side database tables ChrRaces.dbc, CharBaseInfo.dbc, etc), new models/textures, modified Lua for the character creation UI, and map data for new zones. All packaged in an MPQ that players download alongside the client.

As for DRM Blizzard moved away from MPQ to CASC (their own proprietary archive forma) starting in WoD, which makes this kind of modding significantly harder on modern clients. But the classic-era client binaries have been in the wild for 15+ years, so that ship sailed.

When I played on a private server, you used an old version of the client binary. So even if Blizzard implemented DRM now, it wouldn’t impact these old versions.

Similar to the XML config you mentioned, WoW uses/used a plaintext config file where a realmlist URL can be set.