I think they use the unauthenticated .rss and .json routes (which is why they are read-only). The reddit website itself currently relies on these. It’s unclear whether reddit may lock them down in the future but it would likely require frontend updates on their end and massively break mod tools even more than what they’re already doing.