There's a number of ways that you can expose paywalled content to Google without showing it to the user. The obvious one is paywalling content on the client side and hiding it from the user. I actually think this probably explains why client-side paywalling is so prevalent even though it's obviously far less effective. You can also serve your content in structured data that google's bots read (e.g. json+ld). I also think it's a tricky question because people often want to see authoritative sites high up in the search results even if they're paywalled, so "delisting these sites" isn't a solution that satisfies most people.

Hiding content is supposed to be against Google's stated policies.

Try searching for a news article, using the exact same title, as it's published on let's say... Breitbart. Now tell me that Google do not "hide" sites from it's users.

Google's policies explicitly differentiate between paywalled content from what they call cloaking. See the GP's link to the Google developer documentation.