Many servos already have speed control. If you give it a wide distance to travel, it will go faster than if you give it a smaller distance to travel. So, for example, if you give it a 1.5ms pulse train, the hacked servo will stop. A 1.6ms pulse train, the hacked servo will turn slow. A 2ms pulse train, the hacked servo will turn fast. Perhaps their particular servo doesn't have this feature that they need to go through all the trouble to change the pulse train window length?

I think they removed the servo guts. Then they have to use a H-bridge motor controller to run the servo. Thus they can use two wire PWM in that case.

Considering the number of RPM's you can get out of a servo. Most of the time if you gut the servos, you only need to provide 1's or 0's as PWM doesn't get you much of anything speedwise.

The problem with gutting a servo is you now need 4 I/O lines to control two servos, wheras if you leave the guts in, you only need two I/O lines.

Now some guys gut the servos, and then carefully squeeze in tiny quadrature encoder disks and sensors. Then they can measure RPM and distance effectively. But this method is hard to do as the servos are so small. I prefer to come off the output of the servo, using encoder discs and sensors externally.

On some servos, you can bypass the servo IC and use the little h-bridge inside the servo directly. So you sort of, semi-gut out the servo in this case.