I'm far from an expert, but what is most likely is:
- The underlying firmware for the Marvell WiFi controller that Sony provided when they updated the PSP to support WPA (with AES) also supports WPA2 (with AES).
- Sony never set it up on the userspace side, perhaps for stability reasons or because there was no demand and they preferred playing it safe.
- The patches swap out the userspace bits to talk WPA AES with the ones for a WPA2 AES. The difference isn't huge, it's mostly changing data in some management frames and configuring the key exchange differently.
It's very impressive that that developer found the right things to patch, with the right values.
Looks like it has been in the works for a while.