That's not correct; they used ad hoc signing. They collected UDIDs with a configuration profile served over the web. I think enterprise was also an option, but it wasn't the only one – most organisations used ad hoc.