Do they purchase these tokens in a limited quantity and then sell it, or the tokens are available to buy once they have been published on etherscan?

I am confused because how are they able to transfer these tokens from User to User like a c2c transaction? Don't they need ABI and key of owner to interact with the tokens?