No reason they can't fly over the ocean. Airspace in the US is governed by the FAA and while we cannot legally take-off and land in National Parks and now many city / state parks - that does not mean we can't fly near or over them.
Many places in San Diego to fly from that is legal. Truly depends on where this was captured, as news say San Diego, but that covers a huge area.
No idea where they may have launched from as the story would require exactly where this incident happened.
I fly over beaches in North Carolina when I'm there visiting and never had an issue. I don't "buzz" people or typically even get close to them, as I respect their privacy and not intending to capture them - they just happen to be there at the time. Same rules when I'm flying locally as well.
If the pilot took off from a non restricted zone; then they are fully legal to fly. Did they go past VLOS - who knows? Does seem the drone and surfers were pretty far out from land, but who says he was on land. May have been on a boat near by - esp if the person is a shark hunter / watcher. That's where apps like Aloft / B4UFLY / etc come into play - but they are not all inclusive - most state and local rules of restrictions do not show up. You then have to Google search restriction in the area you want to fly for the local / state ones. Sadly, too many states and now cities / towns now restrict drones from taking off / landing in their boundaries. I think we all know the reasons for that.
As stated above - surfers are the types WHO WANT pics / videos of them in action. Yet, like always - keeping a safe distance is a must since surfers and others (hang gliders / etc.) can make some quick moves and you never know when a drone will drop from the sky.