You can accomplish this by putting it all on the client, all on the server, or a mix of both (what they chose).
For all on the server, you could add latency right after receiving data from the client, but before game code processes it, and before sending data to the client.
That said, there likely were technical considerations involved in their decision to do a mix of both.
That's a good point, I hadn't thought of having independent send a receive delays on the server, simulating a delayed connection from the client's perspective without having it participate.
I now wonder too what those technical considerations are, since having the client add latency requires trusting the client to add the delay and not cheat.
For all on the server, you could add latency right after receiving data from the client, but before game code processes it, and before sending data to the client.
That said, there likely were technical considerations involved in their decision to do a mix of both.