Regarding Germany, Austria, Denmark, Sweden, and Norway, details can be found on the Commission website. According to the table of all notifications, they all periodically invoke the “security situation in Europe and threats resulting from the continuous significant secondary movements”. This is obviously in blatant contradiction with article 25 but in practice that doesn't matter. You cannot find anything in there foreseeing unlimited extensions because there isn't. It's as simple as that, no sophisticated legal wizardry is involved (regarding the fate of Juncker's 2017 proposal: that limit hasn't changed since the current framework was introduced in 2013 and is still present in the June 2019 consolidated version of the Borders Code).
By contrast, France's strategy is to ignore the law entirely (as opposed to merely ignoring some specific clause of article 25): introduce quasi-systematic checks on some borders, don't try to create half-hearted legal justifications, don't notify the Commission or invoke some generic “persistent terrorist threat” applying to all borders and count on the Commission to carefully avoid challenging France on this. Back in 2015, the country suffered a string of deadly terrorist attacks and ultimately activated a state of emergency so that it had already invoked the right to reintroduce border controls and did not need any additional notification when the refugee crisis worsened.
The table on the Commission's website gives some additional insight into how all this came to pass. Back in 2015, many countries invoked article 28 with rather specific justifications related to the increasing number of refugees entering the Schengen area. After this initial unilateral move, the Council issued three recommendations to give these countries some legal cover (November 2016, February 2017, and May 2017) while roughly following the letter of article 25 (no more than six-month extension at once, not more than two years of border controls in total). Meanwhile, the Commission initiated a “Back to Schengen” strategy to try to salvage open borders in the Schengen area and make sure they appeared to be in charge.
But in reality, the countries in question were clearly intent on imposing checks no matter what, even if it was not possible to find some other face-saving legal basis. So when the last six-month period expired, they stopped being so specific and just reverted to a generic notification while everybody else turned a blind eye.
Note that the Commission does have a tool to enforce these rules and force a member state to, at the very least, make an effort to offer a more detailed legal rationale for its actions: infringement proceedings. For a long time, rules pertaining to the “Area of freedom, security and justice” were subject to different rules but since 2014, it falls under the ordinary EU law regime. The Commission has however been very shy in launching infringement proceedings on such a politically sensitive topic.
