I've seen some theories or maybe more like guesses as to how the paywall bypass works - I don't think anyone (or at least no one posting places like here) seems to know.

One I saw suggested they've a set of subscriptions to the paywalled sites and some minimal custom work to hide the signed in account used - which seems plausible. That makes the defense most likely used to catch the account used and ban them - which would be a right pain.

They probably just set user agent (and reverse DNS name) to Google or some other company that can bypass the firewall.

This seems the most likely way it works. Which makes me unsympathetic to publishers who complain about it. Digital distribution will always have this issue. Substack goes from strength to strength because they don't give an inch on the paywall.

Maybe they also use Google Cloud to look more convincing.

For example, similar to mondediplo.com