Considering clearbit started at a time when there was not so much focus on privacy and customer data protections... I’m gonna take a wild guess here and say they are scraping it from publicly available (ish) sources.
That is discounting the obvious possibility of looking at ARIN allocations, where in some cases the IP address might be registered to an ASN belonging to the company. In that case it’s a simple lookup.
I'm surprised at Clearbit's accuracy. It knows my (very small) business which is really impressive to me