i feel that if this was done, it was done 'over the wire', more or less on the fly, and not by wholesale appstore replacement but by mitm of internet traffic streams looking for xcode binary material and replacing it, or portions of it, transparently.