How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?

We don't know if Calif bypassed MIE.

When they hacked the M5 (one week after release!), they used a data-only attack, which is outside the scope of MIE. That could be the case here, or something else entirely. We don't know.

https://news.ycombinator.com/item?id=48139219