"Throughout the exercise, ESA had access to the satellite's systems to retain control and ensure a return to normal operation."

My reading of this: ESA let the teams attempt their hacks on the real satellite under supervision.

I guess I don't understand your implicit distrust here - it's just a 2 million EUR, 7 kg satellite explicitly launched for communications experiements.

It is a private press release by a company on its own site, advertising same services touted in the release. I assume every truth that can be bent in their favor has been done so by the PR and Marketing teams. However, the youtube video above with the interview seems much more unequivocal.