I ran a private server years ago. Two things people in this thread are getting wrong: The engineering is way harder than anyone gives credit for. You're reverse engineering a server protocol from the client binary, writing your own spell systems (thousands of spells, each with edge cases), pathing, instancing, combat mechanics. Then scaling it for a few thousand concurrent players on hardware you're paying for out of…
On the client side how did they do this? I worked with a team reverse engineering another MMO a few years ago and it was because of a plain XML config and game launch args that we could make the client connect to a private server easily without modifications. Blizzard could just implement DRM and put an end to all this, right?
For something like Turtle WoW's custom races and zones that means shipping modified DBC files (the client-side database tables ChrRaces.dbc, CharBaseInfo.dbc, etc), new models/textures, modified Lua for the character creation UI, and map data for new zones. All packaged in an MPQ that players download alongside the client.
As for DRM Blizzard moved away from MPQ to CASC (their own proprietary archive forma) starting in WoD, which makes this kind of modding significantly harder on modern clients. But the classic-era client binaries have been in the wild for 15+ years, so that ship sailed.