There aren't that many big addresses on the network, ones that hold over 10 BTC. Craig had to find those addresses and list them.
I'm pretty sure that's not what he did - even CSW isn't
that stupid (although I'm sure many of his followers are).
He'll have gone through early addresses from the first couple of months of bitcoin and listed the ones which are strongly suspected to be linked to Satoshi. These are mostly (or perhaps even exclusively) coinbase transactions from early mined blocks which have never been spent. Various people have done things like this in the past to try to estimate how many coins Satoshi owns, such as here:
https://bitslog.com/2013/04/24/satoshi-s-fortune-a-more-accurate-figure/.
Even if he gets some of them wrong, and lists addresses which don't belong to Satoshi, then his chances of being exposed are very small - the chances of someone having mined a block 10 years ago, not having touched the coins in the intervening 10 years, still be alive and well, still have access to the private keys, and now be willing to move the coins or sign a message for the very first time in 10 years just to prove him wrong, are pretty small.
It that list available to public?
Absolutely. Start here and work along:
https://blockchair.com/bitcoin/block/0