I don't agree that it's simple. You haven't explained how the subroutine reference in @INC gets called. Yes, it could in principle do whatever it wants, but it specifically does

unshift @INC, sub {
    no warnings 'uninitialized';
    ref $_[1] eq 'ARRAY' ? @{$_[1]} : $_[1];
};
[download]

which doesn't call the sub. The sub is somehow passed to the filter when the do reads in the heredoc in the 3-argument open that creates the $fh.

The docs I pointed to above in perldoc perlfunc say:

Subroutine references are the simplest case. When the inclusion system walks through @INC and encounters a subroutine, this subroutine gets called with two parameters, the first being a reference to itself, and the second the name of the file to be included (e.g. "Foo/Bar.pm"). The subroutine should return "undef" or a filehandle, from which the file to include will be read. If "undef" is returned, "require" will look at the remaining elements of @INC.

It says that one value, the filehandle, is returned, but the @INC hook above appears to me to return two values; because the "filename" passed to do is an array ref, and the @INC hook returns @{$_[1]}, those are the items inside the array ref ($fh, sub {...}) passed to do. As the docs say, the @INC hook should return a single $fh, but how is the second return value (sub {...}) called?