How did they get access to the script though? The output seems to be identical to the real PoC, so it looks like the same script.

They got access to the video, not the script. Calif authored the video and it was accidentally made public.

Which makes someone to think, whether Calif could not wait for the responsible disclosure. Or someone leaked the video for someone they should not have.