AIUI some of them are communicated informally by Apple engineers to individuals, some of them are found by using `strings` on the binary and looking at reasonable-seeming keys, any key that actually has a UI to set it is typically found just by setting it in the UI and seeing what changed, some of this stuff may have had UI's in the past that were removed while still leaving the defaults key, some of this stuff may just write the keys into the preferences files automatically and so you can find them just by looking at what's already there, etc.

Skimming this list right now a lot of the stuff I'm seeing definitely has UI settings, so a lot of these are just useful for e.g. automating the setup of a new user.