Yeah, it is primarily around this:
"Cannot be used for lobbying or influencing legislation or political campaigns"
with the key point being "lobbying or influencing legislation" - which is the key point of project 2025, their scorecards for politicians, etc.
I'm sure that:
1. They skirt the regulations, getting as close to what they can get away with w/o crossing the line
2. Count on the regulation being loosely defined. With things like "enhancing social welfare" having no defined measurements
3. Count on people not holding them accountable
4. Count on the IRS not having the time or resources to spend enforcing 501c3 compliance
Event Heritage Action is a 501c4 which has some limits as to what it can do politically (though it has more leeway).
All this being said, I have no background in law so I could be completely wrong.
But this is interesting: https://www.citizensforethics.org/reports-investigations/crew-reports/the-irs-is-not-enforcing-the-law-on-political-nonprofit-disclosure-violations/
As is this:
https://www.motherjones.com/politics/2021/05/heritage-foundation-dark-money-voter-suppression-laws/