C6C server are often servers that got hacked, not servers rented by the attacker.

Security support contracts

For public organisations there are often CERTs (computer emergency response team) responsible for them. For example there is the DFN Cert for all Germany universities. Large companies tend to have support contracts with companies specialized in security.

So after the security breach is noticed, the server may be turned over to the security organisation in order to do forensics: Learn how the attacker got in, try to estimate what damage they caused, to what data they had access, etc. Knowing the damage as good as possible, may be especially important in order to defend against being sued by customers.

This is the most common case. The wording is very similar to what our CERT said when they got handed a C&C server by an university some time ago: "The CERT gained access to a command and control serversserver which collected listsa list of web addresses, usernames and passwords. As the domain of the following entries is within your responsibility please inform your userusers with the following account namenames that their computer is infected".

The security organisations obviously need to prevent drawing attention to their customers because it implies that the customer got successfully attacked.

Other means

The C&C might have been a honeypot, a server dedicated to being attacked. I think this is unlikely because it is said that the c&c server was active for years.

There might have been a court order to seizure the server. But if that was the case and the security company was called as expert witness, they would probably not be allowed to got the public.

The security company might have gotten unauthorized access. I consider this extremely unlikely because of the huge legal risk involved.

tl;dr

The company. which unwillingly hosted the C&C. most likely handed it over to their security consultants for damage assessment.