How did they generate these vanity addresses with 27 predetermined characters?
Your observation is correct and indeed those addresses cannot be generated by vanity address generator in a reasonable amount of time.
Most likely, there is no secret key corresponding to that address and the person chose the p2pkh(and thereby the address) directly. Indeed, by looking at the explorer, there seem to be no outgoing transactions from that address.