As I understand it: If they accept money from Californians, they have a leg to stand on. Similar to the EU/GDPR deal.

Given the examples in the article, they are clearly doing "business" in the state, and doing harm on citizens of the state. If they fail to show up in California court to defend themselves, that would lead to another charge. The state could make extradition requests, or arrest them if they ever show up in the state. It's possible that federal charges could be filed.

I think they have jurisdiction over companies that operate in their territory. I think the EU has the same line of thinking regarding GDPR. Even if the company is outside the EU it still can't provide services in the EU that violate GDPR.

Sovereignty has only the bounds adopted by the sovereign, and US states are sovereign (but, in addition to those in their own law, have adopted, by ratification, any limits on states in the US Constitution, including those in valid federal laws under the Constitution.)

So, the question is, is there anything in those limitations which would deny California authority here?

The same reason US companies need to comply with GDPR.

Why should a company not registered in the state of the alleged criminal be allowed access to the mugshots?

They will need to be extradited to California to face prosecution according to the article.