How do these current pull-up sources work?
These are not ideal current sources. current sources inside ICs are usually implemented as current mirrors.
1: probably a current mirror of some sort.
2: it is assumed that there is a voltage supply between Vin and ground (with no supply the chips behaviour is not specified). So it could flow from ENto ground, ,but if you open that too after the voltage reaches 1.25V it doesn't matter what the current source is doing so it it weakens above 1.25 it will not effect the essestial circuit behaviour. it probably only goes up to about 2 or 3 volts before it runs out of compliance
3: it's not stated but there's probably a direct or indirect connection to Vin
4: When EN gets high enough to turn on the comparitor the extra current comes on pushing EN even higher,
If your spice simulation tells you that EN can produce more voltage than supplied on Vin it's lying to you.