There's a number of ways that you can expose paywalled content to Google without showing it to the user. The obvious one is paywalling content on the client side and hiding it from the user. I actually think this probably explains why client-side paywalling is so prevalent even though it's obviously far less effective. You can also serve your content in structured data that google's bots read (e.g. json+ld). I also think it's a tricky question because people often want to see authoritative sites high up in the search results even if they're paywalled, so "delisting these sites" isn't a solution that satisfies most people.