Yes, I'm also wondering this. Also, how do they get the source code?
You could decompile the game client if you wanted to, but that's probably more trouble than it's worth in most cases. Most of the business logic is in the server anyway, the client is just to initiate actions and render the world state.
(And similarly servers did not have the code, just assets + wire format between client and server, and they reversed engineered things from there, pretty successfully.)