You can get down to a few hundred milliseconds round-trip time over 3G with a fair wind and a bit of luck, or tens of milliseconds over wireless. Depends partly on how much BFL controlled the environment that the tests were carried out in. I don't even bother polling my toy mining FPGA for results more than a few times a second; doesn't really matter that much. (Also, it's convenient in an FPGA design to keep the nonce counter rolling continuously and not bother to reset it for new work units, so any delay is likely to be lost in the noise across two trials.)
I know what wireless is available in the building we were in and I know the response times on those routers - they are way too congested to be of any value for that sort of thing. For 3G, I agree, a few hundred ms, so you're looking at .5 seconds on a good day, probably longer on a bad one, so lets go with .5 round trip. That leaves 3.5 seconds to hash ~4.2 billion nonces, which is (off the top of my head) about 1.3 (?) GH/s? That means either a custom build FPGA rig hidden somewhere (expensive) or a multi GPU rig hidden somewhere with custom mining software able to split the data into partitioned nonce ranges (less expensive, more complex) - and all this would have to be done in LESS than 3.5 seconds, meaning they'd need I'd say at least double the hashrate to overcome the latency issues, so 2.6 GH/s.
Now, all that said, please tell me how likely it is that they have a big, complicated back end with custom backend code and custom front end clients to fool people into believing that the preliminary test of a product at least was able to conduct SHA256 hashes... or... wait for it ... they had a device capable of producing SHA256 hashes at the hashrates observed? Mind you, they do not have this complicated back end to get people to believe in a product they are selling... only to fool people into believing there might be a product in the future. And prior to people believing in this product they will have to produce a real product that does what it claims and let it "into the wild" to be raped and pillaged by yours truly to prove that it does what they say it does?
Now keep in mind that 3.5 seconds is under ideal conditions and where we were is decidedly not ideal conditions. Additionally they were ready and willing to go to the datacenter which is essentially one giant faraday cage and would have prevented any sort of reliable (if any) data connection over wireless (either Wifi or 3G).