the list "mask" for every transaction id is called `voutMask` and it is bitwise AND'ed with the jumbled tx data to get the real transaction id. In that case, the custom `scriptPubKey` is returned. If not, then the default happens, which is to only allow an address which owns funds to actually spend them.