My guess is that works because the article loads a split second before the paywall and Safari (or whatever) has cached that article for reader view. If NYT wanted to get around this they could load only that first part of the article that shows before the paywall until someone signs in with a valid subscription.
