Since Spout never really existed as a working Minecraft server and SpoutCraft was a vanilla client mod I'll assume you mean they were doing selling while being

Since Spout never really existed as a working Minecraft server and SpoutCraft was a vanilla client mod I'll assume you mean they were doing selling while being vanilla mods. In that case, the most likely reason they got away with it isn't because it was a loophole but because it was so under the radar Mojang didn't notice or care.